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Why GAO Did This Study 

Conducting research and 
development (R&D) on 
technologies for detecting, 
preventing, and mitigating terrorist 
threats is vital to enhancing the 
security of the nation's 
transportation system. Following 
the September 11, 2001, terrorist 
attacks, Congress enacted 
legislation to strengthen homeland 
security, in part by enhancing R&D. 
The Transportation Security 
Administration (TSA) and the 
Department of Homeland Security 
(DHS) are the two federal agencies 
with primary responsibility for 
transportation security. 

GAO was asked to assess the 
transportation security R&D 
projects that TSA, DHS, and other 
agencies have funded and assess 
how TSA and DHS are managing 
their transportation security R&D 
programs according to applicable 
laws and best practices. 



What GAO Recommends 



GAO is recommending that TSA 
and DHS improve their 
transportation security R&D 
management by conducting some 
basic research, completing their 
strategic planning and risk 
assessment efforts, developing a 
management information system, 
and better coordinating with other 
federal agencies and reaching out 
to the transportation industry. 
DHS, TSA, and DOT generally 
agreed with the report's findings 
and recommendations. 



www.gao.gov/cgi-bin/getrpt7GAO-04-890. 

To view the full product, including the scope 
and methodology, click on the link above. 
For more information, contact Kate Siggerud 
at (202) 512-2834 or siggerudk@gao.gov. 



What GAO Found 

For fiscal years 2003 and 2004, TSA and DHS funded over 200 R&D projects 
designed to develop technologies for enhancing security in most modes of 
transportation. In fiscal year 2003, TSA spent 81 percent of its $21 million 
transportation security R&D budget for aviation projects, and DHS spent 
about half of its $26 million for projects related to more than one mode of 
transportation. In fiscal year 2004, TSA continued to budget most of its $159 
million for aviation, and DHS also budgeted most of its $88 million for 
aviation, as shown in the table below. According to the National Research 
Council, federal R&D programs should include some basic research, but TSA 
and DHS do not appear to be funding any basic research for transportation 
security. TSA and DHS have not estimated deployment dates for the vast 
majority of their R&D projects. Other federal agencies, such as the 
Department of Transportation (DOT) and the National Aeronautics and 
Space Administration, also funded some transportation security R&D 
projects. Several members of an expert panel on transportation security and 
technology that GAO convened believed the distribution of R&D projects by 
transportation mode was reasonable, while others believed that aviation has 
been overemphasized at the expense of maritime and land modes. 



TSA's and DHS's Transportation Security R&D Funding by Mode, Fiscal Years 2003 and 2004 


Dollars in thousands 




TSA 


DHS 




Transportation 
mode 


Fiscal year 
2003 

(obligated)/(%) 


Fiscal year 
2004 

(budgeted)/(%) 


Fiscal year 
2003 

(obligated)/(%) 


Fiscal year 
2004 

(budgeted)/(%) 


Aviation 


$17,101 (81.1) 


$126,487 (79.5) 


$3,709 (14.3) 


$63,240 (71 .9) 


Highway 


(0.0) 


(0.0) 


1,052 (4.1) 


3,000 (3.4) 


Maritime 


(0.0) 


9,350 (5.9) 


3,474 (13.4) 


1,626 (1.8) 


Multimodal 


3,819 (18.1) 


22,242 (14.0) 


12,630 (48.8) 


20,117 (22.9) 


Pipeline 


(0.0) 


(0.0) 


(0.0) 


(0.0) 


Rail 


169 (0.8) 


1,096 (0.7) 


(0.0) 


(0.0) 


Transit 


(0.0) 


(0.0) 


5,000 (19.3) 


(0.0) 


Total 


$21,089 (100.0) 


$159,175 (100.0) 


$25,865 (100.0) 


$87,983 (100.0) 



Source: GAO analysis of TSA and DHS data. 

TSA and DHS have made some progress in managing their transportation 
security R&D programs according to applicable laws and R&D best 
practices, but neither agency has fully complied with the laws or 
implemented the best practices. For example, neither agency has prepared a 
strategic plan for R&D that contains measurable objectives. In addition, 
although TSA has completed threat assessments for all modes, it has not 
completed vulnerability and criticality assessments. DHS also has not 
completed risk assessments of the infrastructure sectors. Furthermore, both 
TSA and DHS lack complete, consolidated data for managing their R&D 
projects. Finally, although TSA and DHS have made some efforts to 
coordinate R&D with other federal agencies, their outreach to consider the 
concerns of the transportation industry has been limited. 
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M G A O 

^^_^^^^^Accountability ★ Integrity ★ Reliability 

United States Government Accountability Office 
Washington, D.C. 20548 



September 30, 2004 
Congressional Requesters: 

Researching and developing technologies to detect, prevent, and mitigate 
terrorist threats is vital to enhancing the security of the nation's 
transportation system. Following the September 11, 2001, terrorist attacks, 
Congress enacted legislation to strengthen homeland security, in part by 
enhancing research and development (R&D) for transportation security — 
especially for aviation. The recent bombings of the rail system in Madrid, 
Spain, have heightened concern about the security of all modes of 
transportation in the United States, and concern is growing in Congress 
about whether the Transportation Security Administration's (TSA) and the 
Department of Homeland Security's (DHS) efforts to counter terrorist 
threats to the nation's transportation systems are proceeding fast enough 
and are focused on the appropriate technologies. 

To enhance the nation's transportation security, including its R&D 
capabilities, in November 2001, Congress enacted the Aviation and 
Transportation Security Act, which created TSA within the Department of 
Transportation (DOT) and made TSA responsible for security in all modes 
of transportation (aviation, highway, maritime, pipeline, rail, and transit). 
The Homeland Security Act of 2002, passed a year later, established DHS; 
transferred TSA and many other federal agencies to DHS; and made DHS 
responsible for homeland security, including transportation security. The 
act specified, however, that TSA would remain a distinct entity within DHS 
until November 25, 2004. Both laws authorized funding for homeland and 
transportation security R&D and established requirements for its 
management, including requirements for planning and coordination, but 
neither law includes deadlines for implementing these requirements. As 
you requested, we are reporting on 

• the transportation security R&D projects that TSA, DHS, and other 
agencies funded in fiscal year 2003 and have budgeted for in fiscal year 
2004; the status of these projects; and experts' views on the 
reasonableness of the distribution of these projects by mode and 

• the extent to which TSA and DHS are managing their transportation 
security R&D programs according to applicable laws and best practices 
recommended by the National Academy of Sciences and the National 
Research Council. 
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In addition, we are reporting on some new and emerging technologies for 
screening passengers, baggage, and cargo (see app. II). For this review, we 
considered transportation security R&D to encompass the research, 
development, testing, and evaluation of technologies to protect the nation's 
transportation system from terrorist attacks or major crimes. The 
transportation system consists largely of (1) infrastructure, such as 
airports, seaports, border crossings, rail stations, transit stations, 
highways, bridges, tunnels, and pipelines, and (2) vehicles, such as aircraft, 
ships, ferry boats, trucks, buses, automobiles, and trains. We refer to the 
key modes of transportation as aviation, highways, maritime, pipeline, rail 
(passenger and freight), and transit (buses and subways). Because TSA and 
DHS each has its own R&D portfolio, we discuss the two agencies' 
transportation security-related R&D programs separately in this report. 
When we discuss TSA's R&D portfolio, we include projects funded by TSA's 
Office of Security Technologies, Office of Maritime and Land Security, and 
Office of Aviation Operations. Our discussion of DHS's transportation 
security R&D portfolio includes projects funded by DHS's Science and 
Technology Directorate, U.S. Coast Guard, U.S. Customs and Border 
Protection, and U.S. Secret Service. 

To describe the types of transportation security R&D projects that TSA and 
DHS are funding in fiscal year 2003 and plan to fund in fiscal year 2004, we 
analyzed detailed information on their transportation security R&D 
projects. Detailed information on the transportation security R&D projects 
that TSA and DHS plan to fund in fiscal year 2005 was not yet available. 
Although TSA and DHS are the primary federal agencies responsible for 
conducting transportation security R&D, DOT and the National 
Aeronautics and Space Administration (NASA) also fund some 
transportation security R&D projects, and we included information on 
those agencies' projects in this report. We discussed the reliability of 
project and budgetary information with TSA and DHS officials and 
determined that the data they provided were sufficiently reliable for us to 
complete our review. To determine the extent to which TSA and DHS are 
managing their transportation security R&D programs according to 
applicable laws and best practices, we analyzed applicable legal 
requirements for TSA and DHS and best practices for managing R&D 
identified by the National Academy of Sciences and the National Research 
Council; analyzed documentation relating to both agencies' programs; and 
interviewed TSA and DHS officials about their strategic planning and risk 
management. We also interviewed TSA and DHS officials, as well as other 
stakeholders, about the agencies' coordination with other federal agencies 
and outreach to technology providers and the transportation industry. To 
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help evaluate the reasonableness of the distribution of transportation 
security R&D funding by mode and the challenges that TSA and DHS are 
facing in managing their programs, we convened a panel of transportation 
security and technology experts on March 2, 2004. At our request, the 
National Research Council selected the experts, who were affiliated with 
state transportation departments, universities, national laboratories, 
private industry, and other organizations and were knowledgeable about 
transportation security technologies. 

We conducted our review at TSA, DHS, and DOT in Washington, D.C.; at 
TSAs Transportation Security Laboratory in Atlantic City, New Jersey; and 
at the Department of Energy's (DOE) National Laboratories in Los Alamos, 
New Mexico, and Oak Ridge, Tennessee. Appendix I contains detailed 
information about our scope and methodology, and appendix III lists the 
transportation security and technology experts who assisted us in our 
review. We conducted our review from July 2003 through September 2004 
in accordance with generally accepted government auditing standards. 



RGSllltS ill Brief TSA and DHS are funding transportation security R&D projects that are 

aimed at developing technologies to enhance security in most modes of 
transportation. For fiscal years 2003 and 2004, TSA funded 146 
transportation security R&D projects, and DHS funded 56 projects. As 
shown in table 1, in fiscal year 2003, TSA spent about $21 million on 
transportation security R&D projects and budgeted about $159 million for 
fiscal year 2004. In both years, TSA spent or budgeted most of its R&D 
funding for aviation security. TSAs funding for aviation security R&D 
increased from about $17 million in fiscal year 2003 to about $126 million 
for fiscal year 2004, partly because of an appropriation of $55 million for air 
cargo security R&D. Also as shown in table 1, in fiscal year 2003, DHS spent 
about $26 million on transportation security R&D projects and budgeted 
about $88 million for fiscal year 2004. In contrast to TSA, in fiscal year 2003, 
DHS spent almost $13 million, or about 49 percent, of its R&D funding on 
projects related to more than one mode. However, similar to TSA, for fiscal 
year 2004, DHS budgeted the majority of its R&D funding for aviation 
security, increasing the amount from about $4 million in fiscal year 2003 to 
about $63 million. The majority of this increase is for a program to develop 
technical countermeasures to minimize the threat posed to commercial 
aircraft by shoulder-fired missiles, also known as man-portable air defense 
systems. 
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Table 1 : TSA's and DHS's Transportation Security R&D Funding by Mode, Fiscal Years 2003 and 2004 



Dollars in thousands 




TSA 




DHS 




Mode 


Fiscal year 2003 
(obligated) /(%) 


Fiscal year 2004 
(budgeted)/(%) 


Fiscal year 2003 
(obligated)/(%) 


Fiscal year 2004 
(budgeted)/(%) 


Aviation 


$17,101 (81.1) 


$126,487 (79.5) 


$3,709(14.3) 


$63,240 (71.9) 


Highway 


(0.0) 


(0.0) 


1,052 (4.1) 


3,000 (3.4) 


Maritime 


(0.0) 


9,350 (5.9) 


3,474 (13.4) 


1,626 (1.8) 


Multimodal 


3,819(18.1) 


22,242 (14.0) 


12,630 (48.8) 


20,117(22.9) 


Pipeline 


(0.0) 


(0.0) 


(0.0) 


(0.0) 


Rail 


169 (0.8) 


1,096 (0.7) 


(0.0) 


(0.0) 


Transit 


(0.0) 


(0.0) 


5,000 (19.3) 


(0.0) 


Total 


$21,089 (100.0) 


$159,175 (100.0) 


$25,865 (100.0) 


$87,983 (100.0) 



Source: GAO analysis of TSA and DHS data. 

Note: The figures in this table represent transportation security R&D projects funded by TSA's Office of 
Security Technologies. Other TSA offices also funded several transportation security R&D projects in 
fiscal years 2003 and 2004, such as Operation Safe Commerce, the Computer Assisted Passenger 
Prescreening System II, and the Transportation Worker Identification Credential program. However, 
TSA was not able to provide us with funding information for these projects. 

Although TSA and DHS have not decided what additional projects they will 
fund in fiscal year 2005 and beyond, the President's fiscal year 2005 budget 
requests $154 million for TSAs R&D program and about $1 billion for DHS's 
Science and Technology Directorate, which includes some transportation 
security R&D. 1 DOT spent $8 million in fiscal year 2003 and has budgeted 
about $31 million for transportation security R&D projects during fiscal 
year 2004. For example, in 2003, DOT spent about $2 million to develop and 
field-test a system to track trailers containing hazardous materials when 
they are not attached to a tractor; for fiscal year 2004, it budgeted $20 
million to develop a secure information network to share air traffic control 
information with DHS and others. NASA did not fund any transportation 
security R&D projects in fiscal year 2003, but it has budgeted about $18 
million for aviation security R&D projects during fiscal year 2004. Although 
the National Research Council has stated that federal R&D programs 
should include some basic research, project information provided by TSA 
and DHS did not show that any of the transportation security R&D projects 



lr The President's fiscal year 2005 budget request for TSA's R&D program is for R&D in TSA's 
Office of Security Technologies only and does not include R&D in other TSA offices, such as 
the Office of Maritime and Land Security and the Office of Aviation Operations. 



Page 4 



GAO-04-890 Transportation Security R&D 



funded in fiscal year 2003 and budgeted for in fiscal year 2004 were in the 
basic research phase. TSA and DHS also have not estimated deployment 
dates for the vast majority of the projects that they funded in fiscal years 
2003 and 2004. Of the 24 projects for which the two agencies were able to 
estimate deployment dates, 8 are scheduled for deployment as early as this 
fiscal year, and the remaining 16 are scheduled for deployment during fiscal 
years 2005 to 2014. According to a TSA official, deployment dates are not 
always predictable because deployment is dependent on other factors, 
such as funding for purchasing and installing equipment. Several members 
of our panel of transportation security and technology experts believed 
that the distribution of R&D projects by transportation mode was 
reasonable, while others believed that aviation has been overemphasized at 
the expense of maritime and land modes. Finally, some panelists also 
questioned whether some projects should be funded. 

TSA and DHS have made some progress in managing their transportation 
security R&D programs according to applicable laws and R&D best 
practices, but they have not fully complied with these laws or implemented 
best practices. For example: 

• The Homeland Security Act requires DHS to prepare a strategic plan 
that identifies goals and includes annual measurable objectives for 
coordinating the federal government's civilian efforts in developing 
countermeasures to terrorist threats. Similarly, the National Research 
Council has indicated that research programs should be described in 
strategic and performance plans and evaluated in performance reports. 
TSA and DHS have prepared strategic plans for their agencies, and TSA 
has prepared a strategic plan for its R&D program, but these plans do 
not contain measurable objectives for tracking the progress of projects. 
According to DHS officials, the department is preparing a separate 
strategic plan for its R&D program that will include more specific goals 
and measurable objectives. 

• The Aviation and Transportation Security Act requires TSA to use risk 
management principles in making its R&D funding decisions. 
Furthermore, under the Homeland Security Act, DHS is required to 
prepare comprehensive assessments of the vulnerabilities of the 
nation's key resources and critical infrastructure sectors, which include 
transportation. Although both TSA and DHS have established processes 
to select and prioritize R&D projects that include risk management 
principles, they have not yet completed vulnerability and criticality 
assessments, which we have identified as key elements of a risk 
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management approach, for all modes of transportation. 2 In the absence 
of completed risk assessments, for example, TSA and DHS officials are 
using available threat intelligence, expert judgment, and information 
about past terrorist incidents to select and prioritize their R&D projects. 

• The National Research Council has emphasized the need for R&D 
programs to have adequate databases that will provide managers with 
key project management information. TSA's and DHS's R&D managers 
were not able to provide us with complete information on all projects in 
their R&D portfolios. For example, for the 146 projects that it funded in 
2003 and 2004, TSA was not able to provide information on anticipated 
deployment dates for 91 percent of these projects, the current phase of 
development for 49 percent, and the amounts obligated and/or budgeted 
for 8 percent. DHS was not able to provide information on anticipated 
deployment dates for 68 percent of its projects, the current phase of 
development for 14 percent, and the amounts obligated and budgeted 
for 9 percent. Although the National Research Council has stated that 
federal R&D programs should include some basic research, project 
information provided by TSA and DHS did not show that any of the 
transportation security R&D projects that they funded in fiscal year 2003 
and budgeted for in fiscal year 2004 were in the basic research phase. 

• The Aviation and Transportation Security Act and the Homeland 
Security Act require TSA and DHS to coordinate their R&D efforts with 
those of other government agencies. Similarly, the Transportation 
Research Board, a division of the National Research Council, indicates 
that while TSA should have its own analysis and research capability, it 
should also coordinate with the transportation sector, the federal 
government, and the science and technology community. Although TSA 
and DHS have made some efforts to coordinate R&D with each other 
and with other federal agencies, their coordination with DOT has been 
limited. Specifically, officials from the modal administrations of DOT, 
which continue to conduct some transportation security R&D, said that 
they had not provided any input into TSAs and DHS's transportation 
security R&D project selections, nor had TSA or DHS provided any input 
into DOT's transportation security R&D project selections. In addition, 
TSA's and DHS's outreach to the transportation industry has been 
limited. An air cargo association official said that TSA contacted his 



2 GAO, Homeland Security: Key Elements of a Risk Management Approach, GAO-02-150T 
(Washington, D.C.: Oct. 12, 2001). 
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association about the air cargo industry's security R&D needs. However, 
most transportation officials we interviewed said that TSA and DHS had 
not contacted them about their security R&D needs. Consequently the 
transportation industry's security R&D needs may not be adequately 
reflected in TSA's and DHS's R&D portfolios. 

We recognize that TSA and DHS are relatively new agencies that are 
operating in a changing environment. However, until TSA and DHS prepare 
R&D strategic plans with measurable objectives and complete all of their 
risk assessments, Congress and other stakeholders will not have a reliable 
means of assessing TSA's and DHS's progress toward achieving their R&D 
goals or determining whether the millions of dollars that are being invested 
in transportation security R&D projects are being spent cost-effectively and 
address the highest transportation security risks. We are recommending 
that TSA and DHS (1) conduct some basic research, (2) complete their 
strategic planning and risk assessment efforts, (3) develop a management 
information system, and (4) better coordinate with other federal agencies 
and reach out to the transportation industry. We provided TSA, DHS, and 
DOT with draft copies of this report for their review and comment. DHS 
and TSA generally concurred with the draft report's findings and 
recommendations, agreed that the recommendations are key to a 
successful R&D program, and commented that they would continue to 
evaluate their R&D processes in light of the report's findings and 
recommendations. However, DHS believed that the report did not 
sufficiently recognize recent changes that have taken place, particularly at 
TSA. In particular, DHS said that TSA has made great strides in defining 
R&D projects and linking them to mission needs and identified gaps. In 
response to these and other technical comments that DHS provided, we 
have made changes to the report as appropriate. DOT agreed with our 
findings and a recommendation that to improve R&D coordination, a 
memorandum of agreement that defines roles and responsibilities be 
developed between it and DHS. DOT also provided some technical 
comments, which we incorporated where appropriate. See appendix IV for 
DHS's comments and our responses. 



Background ^he na ti° ns transportation system is vast and complex, consisting of about 

3.9 million miles of roads, over 100,000 miles of rail, almost 600,000 bridges, 
over 300 ports, over 2 million miles of pipeline, about 500 train stations, and 
over 5,000 public-use airports. The size of the transportation system, which 
moves millions of passengers and tons of freight every day, makes it both 
an attractive target for terrorists and difficult to secure. Moreover, 
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transportation systems can be used as weapons themselves as was done on 
September 11, 2001. 

As we indicated in our June 2003 report on transportation security 
challenges, 3 transportation experts, state and local governments, and 
industry representatives generally believe that investing in transportation 
security R&D is the federal government's responsibility After the 
September 11, 2001, terrorist attacks, Congress enacted legislation that 
resulted in changes in the federal organization and funding for 
transportation security R&D. In November 2001, the Aviation and 
Transportation Security Act created TSA within DOT and transferred the 
Federal Aviation Administration's (FAA) aviation security R&D program to 
TSA. The act also required TSA to meet a December 31, 2002, deadline for 
deploying explosives detection systems to screen all checked baggage. One 
year later, the Homeland Security Act created DHS and transferred TSA 
from DOT to DHS. This legislation also transferred to DHS several other 
agencies that conducted transportation security R&D, including the U.S. 
Customs Service (now part of U.S. Customs and Border Protection) and the 
U.S. Secret Service from the Department of the Treasury and the U.S. Coast 
Guard from DOT. 4 In addition, the Homeland Security Act extended the 
deadline for deploying new checked baggage screening equipment for 
certain airports to December 31, 2003, and transferred certain chemical and 
biological research programs that have potential transportation security 
applications from the Department of Defense and DOE to DHS. Although 
TSA and DHS have their own research facilities, most of their 
transportation security R&D is conducted by contractors. Figure 1 
identifies major events in the establishment of TSA and DHS. 



3 GAO, Transportation Security: Federal Action Needed to Help Address Security 
Challenges, GAO-03-843 (Washington, D.C.: June 30, 2003). 

4 Under the Homeland Security Act, the Secret Service and Coast Guard remained distinct 
entities within DHS. The Secret Service and Coast Guard portfolio managers said that DHS's 
Science and Technology Directorate does not direct the types of transportation security 
R&D projects that they conduct. 
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Figure 1 : Major Events in the Establishment of TSA and DHS 



2001 


Sept 
Oct 




September 1 1 , 2001 : Terrorist attacks on New York City and 
Washington, D.C. 


Nov 
Dec 




November 19, 2001: Enactment of the Aviation and Transportation Security 
Act, creating TSA and transferring FAA's security R&D program to TSA. 




2002 




Nov 




November 25, 2002: Enactment of the Homeland Security Act of 2002. 


Dec 




December 31 , 2002: Deadline in the Aviation and Transportation Security Act for TSA to 
have explosives detection systems in place at airports to screen all checked baggage. 3 


2003 


Mar 




March 1 , 2003: Start of DHS's operations, including transfer of TSA 
and 21 other agencies to DHS. 




2004 




Nov 




November 25, 2004: Date until which TSA is required by the 
Homeland Security Act of 2002 to remain a distinct entity within DHS's 
Border and Transportation Security Directorate. 


2005 






2005: Fiscal year by which DHS plans to meet the Homeland Security Act of 2002 requirement 
to integrate the department's R&D. 



Sources: Aviation and Transportation Security Act, Homeland Security Act of 2002, and DHS. 



a This deadline was extended to December 31 , 2003, by the Homeland Security Act. 

Under the Aviation and Transportation Security Act, TSA is required to 

• secure all modes of transportation; 

• coordinate transportation security countermeasures with other federal 
government agencies; and 

• accelerate the research, development, testing, and evaluation of 
explosives detection technology for checked baggage and of new 
technology to screen for threats in carry-on items and other items being 
loaded onto aircraft, including cargo, and on persons. 
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TSA's Office of Security Technologies is responsible for the research, 
development, testing, and deployment of security technology 
countermeasures employed to protect the transportation system against 
criminal and terrorist threats. It organizes its R&D projects according to 
the different approaches through which threats can reach a target, such as 
on a person; in carry-on items, vehicles, checked baggage, or cargo; or 
through access points at airports or at marine ports. The Office of Security 
Technologies operates the Transportation Security Laboratory, located in 
Atlantic City, New Jersey, which conducts transportation security R&D and 
tests products submitted by potential vendors for compliance with TSA 
standards. 

Although FAAs aviation security R&D program was moved to TSA and TSA 
has since initiated R&D related to other modes of transportation, several 
DOT administrations 5 conducted transportation security R&D before TSA 
was created and continue to do so. However, security is not the primary 
focus of DOT's R&D programs. 

The Homeland Security Act brought 22 separate federal agencies under 
DHS's umbrella and provided a framework for organizing DHS into five 
directorates, giving the Science and Technology Directorate responsibility 
for DHS's research, development, testing, and evaluation activities and the 
Border and Transportation Security Directorate responsibility for security 
along the nation's borders and in all modes of transportation. The act also 
requires TSA to remain a distinct entity within the Border and 
Transportation Security Directorate until November 25, 2004. 
Consequently, TSA's R&D program office — the Office of Security 
Technologies — currently operates outside of DHS's Science and 
Technology Directorate. 

Under the Homeland Security Act, DHS's Information Analysis and 
Infrastructure Protection Directorate is required to prepare risk 
assessments of the nation's key resources and critical infrastructure, 6 



5 These include the Federal Aviation Administration, the Federal Highway Administration, 
the Federal Motor Carriers' Safety Administration, the Federal Railroad Administration, the 
Federal Transit Administration, and the Research and Special Programs Administration. 

6 The Homeland Security Act refers to the USA Patriot Act for a definition of critical 
infrastructure, which defines it as systems and assets that are so vital to the United States 
that their incapacity or destruction would have a debilitating impact on security, national 
economic security, or national public health or safety See Pub.L. No. 107-56, § 1016(e) 
(2001). 



Page 10 



GAO-04-890 Transportation Security R&D 



which includes transportation. In addition, the Homeland Security Act 
requires the Science and Technology Directorate to 

• coordinate with the appropriate executive branch agencies in 
developing and carrying out the science and technology agenda of the 
department to reduce duplication and identify unmet needs; 

• accelerate the prototyping and development of technologies to address 
homeland security vulnerabilities; and 

• coordinate and integrate all research, development, demonstration, 
testing, and evaluation activities of the department. 

The Science and Technology Directorate's programs are organized by the 
type of threat (e.g., chemical, biological, radiological, nuclear, cyber, and 
high explosives) or by the end-users of the technologies within and outside 
of DHS (e.g., borders and transportation, critical infrastructure protection, 
and emergency preparedness and response). The directorate's four offices, 
as discussed below, are involved in conducting, coordinating, or soliciting 
some transportation-security-related R&D projects. 

• The Office of Programs, Plans, and Budgets establishes overall 
priorities, oversees R&D activities across the Science and Technology 
Directorate, and provides policy guidance for the directorate's 
interactions with other DHS components. The office is organized into 
R&D portfolios that are focused on various types of terrorist threats or 
DHS components. The portfolios involving transportation-security 
related R&D include Border and Transportation Security, High 
Explosives Countermeasures, Biological and Chemical 
Countermeasures, Radiological and Nuclear Countermeasures, the 
Coast Guard, and the Secret Service. 

• The Office of Research and Development executes research, 
development, testing, and evaluation of technologies at DOE and other 
federal laboratories; supports university and fellowship programs; and 
provides an R&D capability dedicated to homeland security. 

• The Homeland Security Advanced Research Projects Agency 
(HSARPA) serves as the department's R&D external funding arm by 
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engaging industry, academia, government, and other sectors in R&D, 
rapid prototyping, 7 and technology transfer. 

• The Office of Systems Engineering and Development takes 

technologies developed by the Office of Research and Development or 
HSARPA and prepares deployment strategies to transfer technologies to 
federal, state, and/or local government users. 



TSA, DHS, and Others 
Are Funding 
Transportation 
Security R&D Projects 
and Experts Had Mixed 
Views about Some 
Projects 



As the primary federal agencies responsible for enhancing the security of 
all modes of transportation, in fiscal year 2003, TSA spent about $21 million 
and DHS spent about $26 million on transportation security R&D projects; 
for fiscal year 2004, TSA and DHS have budgeted about $159 million and 
$88 million, respectively In addition, DOT spent about $8 million on 
transportation security R&D projects in fiscal year 2003 and has budgeted 
about $31 million for fiscal year 2004. NASA did not fund any 
transportation security R&D projects in fiscal year 2003 but has budgeted 
about $18 million for aviation security R&D projects during fiscal year 
2004. TSA and DHS were not able to estimate deployment dates for the vast 
majority of projects that they funded in fiscal years 2003 and 2004. 
Although TSA and DHS have not decided what additional projects they will 
fund in fiscal year 2005 and beyond, the President's fiscal year 2005 budget 
requests $154 million for TSAs R&D program and about $1 billion for the 
Science and Technology Directorate, which includes some transportation 
security R&D. 8 Overall, members of our panel of transportation security 
and technology experts had mixed views about the reasonableness of the 
distribution of transportation security R&D projects by mode and raised 
questions about the types of projects that were funded and not funded by 
TSA and DHS. 



TSA Has Used a Majority Of Overall, TSA increased its funding for transportation security R&D from 
Its R&D Funding for $21 million in fiscal year 2003 to $159 million in fiscal year 2004, as shown 

Aviation Security * n ta ^ e ^- Although TSA is responsible for addressing the security needs of 



7 Rapid prototyping is a process that uses computer-aided design and fabrication to create 
and build a prototype more quickly than through traditional means. 

8 The President's fiscal year 2005 budget request for TSA's R&D program is for R&D in TSA's 
Office of Security Technologies only and does not include R&D in other TSA offices, such as 
the Office of Maritime and Land Security and the Office of Aviation Operations. 
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all modes of transportation, in fiscal year 2003, TSA spent about $17 
million, or about 81 percent, of its R&D funding for projects related to 
aviation security. For fiscal year 2004, TSA has budgeted about $126 million 
on aviation security, or about 79 percent of its R&D budget. This increase 
reflects, in part, a $55 million appropriation for R&D related to air cargo 
screening. According to TSA, it has spent the majority of its R&D funding 
on aviation security because aviation was the greatest concern following 
the September 11, 2001, terrorist attacks and because Congress directed 
TSA to use R&D funding to enhance aviation security. In fiscal year 2004, 
TSA increased its budget for multimodal R&D projects from about $4 
million in fiscal year 2003 to about $22 million. This increase is due, in part, 
to a $5.6 million increase for the Manhattan II project 9 and about $6.4 
million for development of a walk-through trace portal for detecting 
explosives on aviation, maritime, and rail passengers. In fiscal year 2004, 
TSA also increased its budget for rail security R&D projects from $169,000 
in fiscal year 2003 to about $1.1 million. This increase reflects the $1.1 
million that was budgeted for the Transit and Rail Inspection Pilot (TRIP). 10 
TSA also increased maritime security R&D funding from zero in fiscal year 
2003 to about $9 million in fiscal year 2004; this increase is due, in part, to 
$3.6 million for a project to develop equipment to screen vehicles on 
ferries. Finally, TSA did not spend any money for highway, pipeline, or 
transit R&D projects. Several members of our panel of transportation 
security and technology experts commented that R&D for rail and transit 
security warrants additional funding. Congress is considering legislation to 
increase funding for these as well as other modes of transportation in fiscal 
year 2005. For example, the Rail Security Act, S. 2273, which has been 
passed by the Senate Committee on Commerce, Science, and 
Transportation, would authorize $50 million in each of fiscal years 2005 and 
2006 for an R&D program for improving freight and intercity passenger rail 
security. 



9 Manhattan II is TSA's long-term approach for improving checked baggage screening 
systems for aviation as well as maritime and land modes. This program seeks to achieve 
revolutionary improvements in detection capability and operational efficiency in 5 to 10 
years using new screening technologies. TSA plans to award this project's first "proof of 
concept" grants in the fourth quarter of fiscal year 2004. 

10 TRIP is intended to assess the feasibility of the screening of people and their carry-on 
baggage traveling on U.S. trains. 
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Table 2: TSA's Transportation Security R&D Funding by Mode, Fiscal Years 2003 and 
2004 



Aviation Security R&D Projects 
Funded by TSA 



Dollars in thousands 




Fiscal year 2003 




Fiscal year 2004 




Mode 


Obligated 


Percent 


Budgeted 


Percent 


Aviation 


$17,101 


81.1 


$126,487 


79.5 


Highway 





0.0 





0.0 


Maritime 





0.0 


9,350 


5.9 


Multimodal 


3,819 


18.1 


22,242 


14.0 


Pipeline 





0.0 





0.0 


Rail 


169 


0.8 


1,096 


0.7 


Transit 





0.0 





0.0 


Total 


$21,089 


100.0 


$159,175 


100.0 



Source: GAO analysis of TSA data. 



Note: The figures in this table represent transportation security R&D projects funded by TSA's Office of 
Security Technologies. Other TSA offices also funded several transportation security R&D projects in 
fiscal years 2003 and 2004, such as Operation Safe Commerce, the Computer Assisted Passenger 
Prescreening System II, and the Transportation Worker Identification Credential program. However, 
TSA was not able to provide us with funding information for these projects. 

In fiscal years 2003 and 2004, TSA spent or budgeted R&D funds for 
projects in several aviation security program areas, including the following: 

• Aviation Checked Baggage: To improve the detection capability and 
operational efficiency of its current checked baggage-screening 
program, TSA has both near-term (1 to 3 years) and long-term R&D 
programs. To date, TSA has spent most of its checked baggage screening 
R&D funds on the near-term programs. In fiscal year 2003, it obligated 
about $12 million, and, for fiscal year 2004, it budgeted about $27 million 
for near-term activities; whereas for long-term activities under the 
Manhattan II project, it obligated $75,000 in fiscal year 2003 and has 
budgeted $5.6 million for fiscal year 2004. Most of the near-term 
activities are to develop next-generation checked baggage screening 
equipment through the Phoenix project, which is funded jointly by 
government and industry. As part of the Phoenix project, in September 
2003, TSA awarded $9.4 million to enter into five cooperative 
agreements with private sector firms to enhance existing systems and 
develop new screening technologies. For example, in fiscal year 2003, 
TSA spent almost $2.4 million to have a contractor develop a new 
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computed tomography explosives detection system 11 that is smaller and 
lighter than systems currently deployed in airport lobbies. The new 
system is intended to replace the systems currently placed in airport 
lobbies, including both larger, heavier explosives detection systems and 
explosives trace detection equipment. The smaller size of the system 
creates opportunities for TSA to transfer screening operations to other 
locations, such as airport check-in counters. TSA expects to certify this 
equipment later this year. TSA is also working with a contractor to 
integrate technologies, such as quadrupole resonance, 12 with its 
existing explosives detection systems to improve processing speed and 
detection capability and to reduce false alarm rates and human 
resource requirements. 

• Aviation Checkpoint: To address the limitations of its current metal 
detectors for screening passengers and of X-ray machines for screening 
carry-on baggage, TSA, in fiscal year 2003, obligated about $1 million 
and has budgeted $18 million for fiscal year 2004. For example, during 
the summer of 2004, TSA installed and began testing explosives trace 
detection portals at four airports and had scheduled to test the portal at 
a fifth airport in the near future. Passengers who enter a checkpoint lane 
with a trace portal machine will proceed through the metal detector 
while their carry-on baggage is being screened by X-ray. Each passenger 
will then be asked to step into the trace portal and to stand still for a few 
seconds while several quick puffs of air are released, as shown in figure 
2. The portal will analyze the air for traces of explosives as the 
passenger walks through, and a computerized voice will tell the 
passenger when to exit the portal. 



n A computed tomography explosives detection system uses an X-ray source that rotates 
around a bag, obtaining a large number of cross-sectional images that are integrated by a 
computer, which displays the densities of objects in the bag. The system automatically 
triggers an alarm when objects with high densities, which are characteristic of explosives, 
are detected. 

12 Quadrupole resonance uses radio frequency pulses to probe bags by eliciting unique 
responses from explosives based on their chemical characteristics. 
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Figure 2: A Walk-through Explosives Trace Detection Portal 




Source: Smiths Detection. 



To help focus its screening resources on the highest risk passengers, in 
fiscal years 2003 and 2004, TSA worked to develop the Computer 
Assisted Passenger Prescreening System II (CAPPS II). 13 CAPPS II is 
intended to identify terrorists and other high-risk individuals before 
they board commercial airplanes. Originally TSA intended to conduct a 
risk assessment of each passenger using national security information, 
commercial databases, and information provided by the passenger 
during the reservation process — specifically, the passenger's name, 



13 TSA was not able to tell us how much it had obligated and budgeted for CAPPS II in fiscal 
years 2003 and 2004, respectively. 
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date of birth, home address, and home telephone number. In our 
February 2004 report on CAPPS II, we found that TSA was behind 
schedule in testing and developing initial increments of CAPPS II and 
had not yet completely addressed other issues, including concerns 
about privacy and the accuracy of the data used for CAPPS II. 14 In 
August 2004, a DHS official said that DHS was revising the program 
with an emphasis on fully protecting passengers' privacy and civil 
liberties. 

• Aviation Cargo: To enhance the security of the nation's air cargo 
system, TSA obligated about $700,000 in fiscal year 2003 for cargo 
security R&D and has budgeted about $53 million for fiscal year 2004. 
For example, as part of its Air Cargo Strategic Plan, TSA plans to 
develop a prescreening system to identify high-risk cargo and to work 
with the appropriate stakeholders to ensure that all such cargo is 
inspected. To complete its inspection of high-risk cargo, TSA has a 
number of R&D projects, one of which is a project budgeted at $19.5 
million for fiscal year 2004 to research and develop equipment for the 
detection of threats in containerized air cargo and mail. Under this 
project, TSA is considering funding several technologies, including high- 
power computed tomography and X-ray combined with pulsed fast 
neutron analysis. 15 

In its July 2004 report, the National Commission on Terrorist Attacks Upon 
the United States expressed concerns about checked baggage, checkpoint, 
and cargo security. 16 The commission recommended that TSA and 
Congress give priority attention to improving the ability of screening 
checkpoints to detect explosives on passengers. The commission also 
stated that TSA should (1) expedite the installation of advanced in-line 
baggage screening equipment; (2) require that every passenger aircraft 
carrying cargo deploy at least one hardened container to carry any suspect 
cargo; and (3) intensify its efforts to identify, track, and appropriately 
screen potentially dangerous cargo in both aviation and maritime modes. 



14 GAO, Aviation Security: Computer-Assisted Passenger Prescreening System Faces 
Significant Implementation Challenges, GAO-04-385 (Washington, D.C.: Feb. 12, 2004). 

15 Pulsed fast neutron analysis probes targets, using high-energy neutrons, for the presence 
of explosives. 

16 National Commission on Terrorist Attacks Upon the United States, The 9/11 Commission 
Report: Final Report of the National Commission on Terrorist Attacks Upon the United 
States (Washington, D.C.: 2004). 
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Maritime and Land Security R&D In addition to its R&D projects to enhance aviation security, in fiscal years 
Projects Funded by TSA 2003 and 2004, TSA spent or budgeted R&D funds for projects to improve 

security for maritime and land transportation, including the following: 



• The Transit and Rail Inspection Pilot will assess the feasibility of using 
emerging technologies to screen passengers and their checked baggage 
and carry-on items for explosives at rail stations and aboard trains. In 
May 2004, TSA completed a 30-day test to screen Amtrak and commuter 
rail passengers for explosives at a Maryland train station by having them 
walk through a trace detection portal that TSA is also considering for 
use at airports. According to TSA officials, the test provided useful 
information about customer-screening wait times, the effectiveness of 
screening equipment in a non-climate-controlled environment, and the 
cost and impact of using the technology for Amtrak and commuter rail 
operations. In addition, in June and July 2004, TSA tested the screening 
of Amtrak passengers' checked baggage for explosives at a Washington, 
D.C., train station, and in July 2004, TSA tested the screening of 
passengers and their carry-on items for explosives on a Connecticut 
commuter rail train while the train was in motion. 

• The Transportation Worker Identification Credential is intended to 
establish a uniform, nationwide standard for the secure identification of 
as many as 12 million public- and private-sector workers who require 
unescorted physical or cyber access to secure areas at airports and 
other transportation facilities, such as seaports and railroad terminals. 
TSA was not able to provide funding information for the program for 
fiscal years 2003 and 2004. As we have previously reported, airport and 
seaport officials have expressed concern about how much the program 
would cost and who would pay to implement it. 17 We have recently 
completed a separate review that looked at pilot tests of the program at 
maritime ports and expect to issue a report to the House Transportation 
and Infrastructure Committee by September 30, 2004. 

• The Conveyance Tracking Program is investigating the capability of 
technologies that are or are nearly available for the secure tracking of 
hazardous materials shipments by rail and truck. TSA budgeted about $1 
million for this program for fiscal year 2004. 



17 GAO, Posthearing Questions Related to Aviation and Port Security, GAO-04-315R 
(Washington, D.C.: Dec. 12, 2003), and Aviation Security: Progress Since September 11, 
2001, and the Challenges Ahead, GAO-03-1150T (Washington, D.C.: Sept. 9, 2003). 
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• Operation Safe Commerce is designed to improve container supply 
chain security by testing practices and commercially available 
technologies in an operational environment, including technologies for 
tracking and tracing containers, nonintrustive detection of threats, and 
sealing containers. In June 2003, TSA awarded grants to the ports of Los 
Angeles and Long Beach, California; Seattle and Tacoma, Washington; 
and the Port Authority of New York and New Jersey. TSA was not able to 
provide funding information for the program for fiscal years 2003 and 
2004. 

TSA Spent or Budgeted Most of For our review, we classified R&D projects according to the following four 
Its R&D Funding for Projects phases: 
That Are Beyond the Basic 

Research Phase • Basic research includes all scientific efforts and experimentation 

directed toward increasing knowledge and understanding in those fields 
of physical, engineering, environmental, social, and life sciences related 
to long-term national needs. 

• Applied research includes all efforts directed toward the solution of 
specific problems with a view toward developing and evaluating the 
feasibility of proposed solutions. 

• Advanced development includes all efforts directed toward projects that 
have moved into the development of hardware for field experiments and 
tests. 

• Operational testing includes the evaluation of integrated technologies 
in a realistic operating environment to assess the performance or cost 
reduction potential of advanced technology. 

In fiscal years 2003 and 2004, TSA spent or budgeted the majority of its 
transportation security R&D funding for projects in the last three phases of 
R&D, but the agency agrees that it needs to spend more for basic research. 
Figure 3 shows TSAs allocation of R&D funding by phase of R&D. In fiscal 
year 2003, TSA spent about 88 percent of its $21 million budget on applied 
research, advanced development, and operational testing. For fiscal year 
2004, TSA budgeted about 82 percent of its $159 million budget for projects 
in those three phases. In contrast, according to project information 
provided by TSA, none of the transportation security R&D projects that it 
funded in fiscal year 2003 and budgeted in fiscal year 2004 were in the basic 
research phase. According to the National Research Council, R&D 
organizations should consistently fund some basic research because 
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although it typically entails higher risks, it also offers higher payoffs than 
R&D in later phases. Thus far, TSA has focused its R&D efforts on making 
improvements to deployed technologies and testing and evaluating near- 
term technologies, and a senior TSA official acknowledged that the agency 
needs to do more basic research. 



Figure 3: Distribution of TSA's R&D Funding by Phase, Fiscal Years 2003 and 2004 
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Phase of R&D 



Fiscal year 2003 (obligated - $21 .1 million) 
Fiscal year 2004 (budgeted - $159.2 million) 
Source: GAO analysis of TSA data. 

Note: TSA provided the R&D phase for 74 of the 146 projects that it funded in fiscal years 2003 and 
2004. TSA officials did not explain why the information was not available on the R&D phase for the 
remaining 72 projects. 
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TSA Has Not Estimated Although many of TSAs projects are in later phases of development, the 

Deployment Dates for Most of Its agency has not estimated deployment dates for 133 of the 146 projects that 
R&D Projects it funded in fiscal years 2003 and 2004. According to TSA officials, 

deployment dates are not always predictable because deployment is 
dependent on factors such as the manufacturing capacity of the private 
sector or the availability of funds for purchasing and installing equipment. 
However, we generally believe that R&D program managers should 
estimate deployment dates for projects that are beyond the basic research 
phase because deployment dates can serve as goals that the managers can 
use to plan, budget, and track the progress of projects. For the 13 projects 
for which TSA had estimated deployment dates, deployment is scheduled 
for fiscal years 2004 through 2014. Nine of the 13 projects are scheduled for 
deployment in fiscal years 2005 or 2006, including the Phoenix project, 
which is intended to enhance existing checked baggage screening systems 
and develop new screening technologies. One of the remaining 4 projects, 
the Manhattan II project, is scheduled for deployment from fiscal years 
2009 through 2014. 



Transferring R&D Funds to Progress on some R&D projects was delayed in fiscal year 2003 when TSA 

Other Programs Delayed TSAs transferred about $61 million, more than half of its $110 million R&D 
Progress on Some R&D Projects appropriation, to operational needs, such as personnel cost for screeners. 

As a result, TSA delayed several key R&D projects related to checked 
baggage screening, checkpoint screening, and air cargo security. For 
example, TSA delayed the development of a device to detect weapons, 
liquid explosives, and flammables in containers found in carry-on baggage 
or passengers' effects, as well as the development and testing of a walk- 
through portal for detecting traces of explosives on passengers. According 
to a TSA official, the agency does not plan to transfer R&D funds to other 
programs in fiscal year 2004. 
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DHS Spent the Majority of 
Its Fiscal Year 2003 and 
Budgeted the Majority of Its 
Fiscal Year 2004 
Transportation Security 
R&D Funding for 
Multimodal and Aviation 
Projects 



Overall, DHS increased its funding for transportation security R&D from 
about $26 million in fiscal year 2003 to about $88 million in fiscal year 2004, 
as shown in table 3. 18 The President's fiscal year 2005 budget request 
includes about $1 billion for the Science and Technology Directorate, 
which includes some transportation security R&D. 



Table 3: DHS's Transportation Security R&D Funding by Mode, Fiscal Years 2003 
and 2004 



Dollars in thousands 





Fiscal year 2003 




Fiscal year 2004 




Mode 


Obligated 


Percent 


Budgeted 


Percent 


Aviation 


$3,709 


14.3 


$63,240 


71.9 


Highway 


1,052 


4.1 


3,000 


3.4 


Maritime 


3,474 


13.4 


1,626 


1.8 


Multimodal 


12,630 


48.8 


20,117 


22.9 


Pipeline 





0.0 





0.0 


Rail 





0.0 





0.0 


Transit 


5,000 


19.3 





0.0 


Total 


$25,865 


100.0 


$87,983 


100.0 



Source: GAO analysis of DHS data. 



In fiscal year 2003, DHS spent $12.6 million, or almost half, of its $26 million 
transportation security R&D budget for projects related to multiple modes 
of transportation. For fiscal year 2004, DHS increased its budget for 
multimodal projects to $20 million; this increase reflects the costs of 
funding pilot programs with the Port Authority of New York and New 
Jersey to test radiation and nuclear detection devices. For fiscal year 2004, 
DHS budgeted almost $63 million, or 72 percent of its $88 million, on 
aviation projects, compared with almost $4 million spent in fiscal year 
2003. This increase provides about $60 million in fiscal year 2004 funds to 
develop technical countermeasures to minimize the threat posed to 
commercial aircraft by shoulder-fired missiles, also known as man-portable 



18 Some of DHS's transportation security R&D projects are funded and managed by DHS's 
Science and Technology Directorate, while others are funded and managed by other DHS 
agencies, namely the Coast Guard, Customs and Border Protection, and the Secret Service. 
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air defense systems (MANPADS). 19 Figure 4 shows a MANPADS that could 
be used to attack a commercial aircraft. 



Figure 4: Photograph of a MANPADS 




Source: U.S. Department of the Army. 



19 In our January 2004 report on DHS's effort, we found that DHS faces significant challenges 
in adapting a military counter-MANPADS system to commercial aircraft, including 
establishing system requirements, developing the technology and design to a mature level, 
and developing reliable cost estimates. (GAO, The Department of Homeland Security Needs 
to Fully Adopt a Knowledge-based Approach to Its Counter-MANPADS Development 
Program, GAO-04-341R (Washington, D.C.: Jan. 30, 2004).) 
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DHS decreased its budget for transit security R&D projects from $5 million 
in fiscal year 2004 to $0 in fiscal year 2004; this decrease reflects the 
completion of a project to test chemical detectors in subway stations. DHS 
also increased its budget for highway security R&D projects from $1 
million in fiscal year 2003 to $3 million in fiscal year 2004. This increase 
funds a project to research and develop technology for detecting truck 
bombs. Figure 5 shows an example of a truck bomb detection system. 



Figure 5: A Mobile Search X-ray Inspection System for Detecting Truck Bombs 




Source: American Science and Engineering. 



DHS Spent or Budgeted Most of In fiscal year 2003, DHS spent 25 percent and 60 percent of its $26 million 
Its R&D Funding for Projects transportation security R&D budget for projects in advanced development 
That Are in Advanced and multiple phases, respectively, as shown in figure 6. For fiscal year 2004, 

Development DHS budgeted $61 million, or 69 percent, of its $88 million budget for 

advanced development, including $60 million for the counter-MANPADS 
program. According to project information provided by DHS, none of the 
transportation security R&D projects it funded in fiscal year 2003 and 
budgeted for in fiscal year 2004 were in the basic research phase. Although 
DHS has focused its initial R&D efforts on the near-term development and 
deployment of technologies, it recognizes the importance of basic research 
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and, according to a senior DHS official, intends to do more basic research 
in fiscal year 2006 and beyond. 



Figure 6: Distribution of DHS's R&D Funding by Phase, Fiscal Years 2003 and 2004 
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Fiscal year 2003 (obligated - $25.9 million) 
Fiscal year 2004 (budgeted - $88.0 million) 
Source: GAO analysis DHS data. 

Of the 56 projects that DHS funded in fiscal years 2003 and 2004, DHS has 
deployed technologies related to 7, has estimated deployment dates for 11, 
and has not estimated deployment dates for the remaining 38. Estimated 
deployment dates for the 11 projects range from fiscal years 2004 to 2007. 
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DOT and NASA Funded 
Some Transportation 
Security R&D Projects 



In addition to the transportation security R&D projects funded by TSA and 
DHS, DOT and NASA funded some such projects. In fiscal year 2003, DOT 
spent about $8 million and has budgeted about $31 million for fiscal year 
2004 on transportation security R&D, as shown in table 4. For example, in 
fiscal year 2003, DOT spent about $2 million to develop and field-test a 
system to track trailers containing hazardous materials when they are not 
attached to a tractor; for fiscal year 2004, it budgeted $20 million to develop 
a secure information network to share air traffic control information with 
DHS and others. 



Table 4: DOT'S Transportation Security R&D Funding by Mode, Fiscal Years 2003 
and 2004 



Dollars in thousands 



Fiscal year 2003 Fiscal year 2004 



Mode 


Obligated 


Percent 


Budgeted 


Percent 


Aviation 


$0 


0.0 


$20,000 


65.0 


Highway 


3,531 


43.8 


400 


1.3 


Maritime 





0.0 





0.0 


Multimodal 


906 


11.2 


7,858 


25.5 


Pipeline 


900 


11.2 


412 


1.3 


Rail 


400 


5.0 


400 


1.3 


Transit 


2,325 


28.8 


1,694 


5.5 


Total 


$8,062 


100.0 


$30,764 


100.0 



Source: GAO analysis of DOT data. 



Although NASA did not fund any transportation security R&D in fiscal year 
2003, it has budgeted about $18 million for fiscal year 2004 for aviation 
security R&D projects. For example, NASA budgeted about $5 million for 
technologies and methods to provide accurate information so that pilots 
can avoid protected airspace, continually verify identity, and prevent 
unauthorized persons from gaining access to flight controls. 
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Experts Had Mixed Views 
on the Reasonableness of 
Distribution of 
Transportation Security 
R&D Projects, and Some 
Experts Questioned 
Decisions to Fund Some 
Projects 



Members of our panel of transportation security and technology experts 
had mixed views on whether the distribution of transportation security 
R&D projects by mode was reasonable and raised questions about whether 
some projects should be funded. According to several panelists, the 
distribution of transportation security R&D projects by mode and program 
area was reasonable. However, several other panelists said that aviation 
has been overemphasized at the expense of maritime and land modes; two 
panelists felt that R&D is focused too heavily on threats that were 
prominent in the 1970s and 1980s, such as airplane hijackings and 
bombings; and one panelist said that the selection of projects seemed to be 
inappropriately based on the most recent terrorist event or perceived 
threat. While the panelists had different and sometimes conflicting views 
about the reasonableness of the distribution of projects, many of them said 
that project selections should be based on current risk assessments. As 
explained in the next section of this report, TSA and DHS plan to select 
their R&D projects on the basis of risk assessments, which have not yet 
been completed for all modes of transportation. 



When asked whether they thought there were any transportation security 
R&D projects in the agencies' portfolios that did not merit funding, the 
panelists identified several funded by TSA that they believed did not qualify 
as R&D projects. For example, one panelist did not agree with funding 
projects that were designed to enhance existing technologies, such as a 
$30,000 project to test a prototype of a new, handheld ion mobility 
spectrometry explosives trace detector. According to this panelist, at least 
two very good ion mobility spectrometry handheld units can be purchased 
off the shelf. In commenting on a draft of this report, DHS said that TSA 
funded this project because the vendor demonstrated a promising 
technology. 

When asked if there were any important areas of transportation security 
R&D that TSA and DHS were not addressing, individual panelists suggested 
that the following projects be considered for future funding: 

• A project for combining neutron inspection technology with traditional 
transmission X-ray and backscatter X-ray technologies could enhance 
air cargo security by providing a thorough look at places where 
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explosives might be concealed in containers. 20 A ground-based system 
to scan trucks carrying cargo bound for passenger aircraft, ships, and 
highways could also be tested. 

• A multifunctional portal that tests for metals, explosives, narcotics, and 
chemicals in near real time could help to address the limitations of 
current checkpoint screening equipment. 

• A standard piece of luggage for testing deployed explosives detection 
systems could be developed to ensure that the systems maintain 
acceptable performance capabilities. 

In commenting on a draft of this report, DHS addressed several 
technologies and projects, including neutron inspection technology, a 
multifunctional portal project, and a project to develop a standard piece of 
luggage for testing explosives detection systems. Specifically, DHS said 
that TSA is looking at pulsed fast neutron analysis, a technology that uses 
X-ray images in conjunction with neutron interrogation and substance 
identification. According to DHS, TSA considers the development of a 
multifunctional portal critical because it creates opportunities for fusing or 
integrating technologies — a long-standing transportation goal. Finally, DHS 
said that a standard piece of luggage had been developed to validate the 
performance of two different explosives detection systems to ensure that 
the systems are performing to their certification levels. Moreover, DHS 
noted in its comments that TSA has two advisory committees — the 
National Academy of Sciences and the Security Advisory Panel — whose 
members have expertise in various modes of transportation. 



20 Neutron inspection techniques use neutron beams that penetrate an object and react with 
concealed explosives. Traditional transmission X-ray images create a "shadowgram" image, 
similar to the result of a medical X-ray, when X-rays pass through an object and are 
absorbed, rather than scattered. While transmission technology can reveal fine details such 
as wires and other bomb components, the more objects or clutter in the path of the beam, 
the less object differentiation is achieved. Backscatter X-ray detects reflected X-ray energy, 
providing an image that highlights organic materials such as explosives — materials that 
traditional transmission-only systems can miss. 
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TSA and DHS Have 
Made Some Progress in 
Managing Their R&D 
Programs but Have Not 
Yet Fully Completed 
Their Efforts 



TSA and DHS have made some progress in managing their transportation 
security R&D programs according to applicable laws and R&D best 
practices, 21 but their efforts are incomplete in the following areas: 

• preparing strategic plans that contain goals and measurable objectives, 

• preparing and using risk assessments to select and prioritize their R&D 
projects, 

• maintaining a comprehensive database of R&D projects, 

• coordinating their R&D programs with those of other government 
agencies, 



reaching out to transportation stakeholders to help identify R&D needs, 
and 



• accelerating R&D. 



The Homeland Security Act also authorizes DHS to solicit R&D proposals 
for security technologies from outside entities and requires DHS to 
integrate the department's R&D programs. Although the laws do not 
contain deadlines for TSA and DHS to complete these requirements, it is 
difficult to determine, until the agencies do, whether they are making R&D 
investments cost-effectively and addressing the highest transportation 
risks. In commenting on their progress in managing TSAs R&D program, 
TSA officials said that the agency was focusing initially on hiring new 
airport screeners and meeting statutory requirements to install new 
screening equipment. They further noted that a substantial transfer of R&D 
funds in fiscal year 2003 delayed certain projects. DHS officials said that 
the department is a start-up organization. Table 5 shows the progress TSA 
and DHS have made in complying with statutory requirements and best 
practices for managing their R&D programs. 



21 National Academy of Sciences, Evaluating Federal Research Programs: Research and the 
Government Performance and Results Act (Washington, D.C.: National Academy Press, 
1999), and National Research Council, World-Class Research and Development- 
Characteristics for an Army Research, Development, and Engineering Organization 
(Washington, D.C.: National Academy Press, 1996). 
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Table 5: TSA's and DHS's Implementation of Statutory Requirements and Best Practices for Managing Their R&D Programs 



Requirement/Best practice 

The Homeland Security Act requires DHS to 
prepare a strategic plan that identifies goals 
and includes annual measurable objectives 
for coordinating the federal government's 
civilian efforts in developing 
countermeasures to terrorist threats. In 
addition, the National Academy of Sciences 
indicates that research programs should be 
described in strategic and performance 
plans. 

The Aviation and Transportation Security 
Act requires TSA to use risk management 
principles to make R&D decisions. The 
Homeland Security Act requires DHS to 
prepare comprehensive risk assessments 
for the nation's key resources and critical 
infrastructure sectors. In addition, GAO has 
advocated the use of a risk management 
approach in responding to national security 
and terrorism challenges. 

The National Research Council indicates 
that R&D organizations should maintain a 
complete database of projects to help 
prioritize and justify expenditures. 

The Aviation and Transportation Security 
Act and the Homeland Security Act require 
TSA and DHS to coordinate their R&D 
efforts with those of other government 
agencies. 

The Transportation Research Board 
indicates that R&D organizations should 
reach out to stakeholders to obtain input on 
their R&D decisions. 

The Aviation and Transportation Security 
Act requires TSA to accelerate R&D on 
aviation security technologies, and the 
Homeland Security Act requires DHS to 
accelerate R&D on homeland security 
technologies. 



TSA's implementation 

Partial — TSA prepared strategic plans for 
the agency and its R&D program, but the 
plans did not contain goals or measurable 
objectives. 



Partial — According to TSA officials, threat 
assessments were completed for all modes 
of transportation, but vulnerability and 
criticality assessments have not been 
completed. 



Partial — TSA's database of projects does 
not provide key information on all projects. 



Partial — TSA's efforts to coordinate with 
other federal agencies have been limited. 



Partial — TSA's efforts to reach out to the 
transportation industry have been limited. 



Unable to assess because of the absence of 
measurable objectives. 



DHS's implementation 

Partial — DHS prepared a strategic plan for 
the department, but the plan does not 
contain measurable objectives. DHS is in 
the process of preparing a strategic plan for 
its R&D program. 



Partial — DHS is working in a pilot phase 
toward preparing national comparative risk 
assessments for infrastructure sectors with 
critical vulnerabilities. 



Partial — DHS's database of projects does 
not provide key information on all projects. 



Partial — DHS's efforts to coordinate with 
other federal agencies have been limited. 



Partial — DHS's efforts to reach out to the 
transportation industry have been limited. 



Unable to assess because of the absence of 
measurable objectives. 



DHS is drafting an integration plan and has 
been directed by the Secretary of Homeland 
Security to integrate the department's R&D 
activities by 2005. 



The Homeland Security Act requires DHS to Not applicable. 

integrate the department's various R&D 

activities. 



Source: GAO analysis of applicable laws, best practices, and information provided by TSA and DHS. 

Note: Analysis of implementation status is based on agency officials' comments and our review of 
applicable documents and databases. 
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Strategic Plans for TSA's and The Homeland Security Act requires DHS to prepare a strategic plan that 
DHS's R&D Programs Do identifies goals and includes annual measurable objectives for coordinating 
Not Yet Contain Measurable ^ e ^ e( ^ era ^ government's civilian efforts in developing countermeasures to 
~, . . terrorist threats. Similarly, R&D best practices identified by the National 

J Academy of Sciences indicate that research programs should be described 

in strategic and performance plans and evaluated in performance reports. 
TSA has prepared strategic plans for both the agency 22 and its R&D program 
that contain performance goals, such as deterring foreign and domestic 
terrorists and other individuals from causing harm or disrupting the 
nation's transportation system. Although we reported in January 2003 23 that 
TSA had established an initial set of 32 performance measures, none of 
them are contained in TSAs strategic plans or directly pertain to R&D. 

DHS has prepared a strategic plan for the department, but the plan's broad 
objective — to develop technology and capabilities to detect and prevent 
terrorist attacks — is not supported by more specific R&D performance 
goals and measures in any program area, including transportation. A DHS 
official said that the department is preparing a separate strategic plan for 
its R&D program that will include more specific goals and measurable 
objectives. Another DHS official said that the plan will include input from 
the leaders of the Science and Technology Directorate's functional areas, 
one of which is transportation. DHS has indicated that the Science and 
Technology Directorate's strategic planning process includes (1) 
determining strategic goals for the next 5 years, threats, and vulnerabilities 
and (2) developing a list of prioritized projects for fiscal years 2005 through 
2010. In a May 2004 report on DHS's use of the DOE national laboratories 
for research on technologies for detecting and responding to nuclear, 
biological, and chemical threats, we recommended that DHS complete a 
strategic plan for R&D. 24 Until TSA and DHS prepare R&D strategic plans 
with goals and measurable objectives, Congress and other stakeholders do 
not have a reliable means of assessing TSA's and DHS's progress toward 
achieving their R&D goals. 



22 As of August 2004, TSA's September 2003 strategic plan was still in draft form. 

23 GAO, Transportation Security Administration: Actions and Plans to Build a Results- 
Oriented Culture, GAO-03-190 (Washington, D.C.: Jan. 17, 2003). 

24 GAO, Homeland Security: DHS Needs a Strategy to Use DOE's Laboratories for Research 
on Nuclear, Biological, and Chemical Detection and Response Technologies, GAO-04-653 
(Washington, D.C.: May 24, 2004). 
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TSA and DHS Plan to Use 
Risk Assessments to 
Prioritize and Select Their 
R&D Programs, but Many 
Assessments Have Not Been 
Completed 



The Aviation and Transportation Security Act requires TSA to use risk 
management principles in making R&D funding decisions. 25 The Homeland 
Security Act requires DHS to establish R&D priorities for detecting, 
preventing, protecting against, and responding to terrorist attacks 26 and to 
prepare comprehensive assessments of the vulnerabilities of the nation's 
key resources and critical infrastructure sectors, one of which is 
transportation. 27 In addition, under the Homeland Security Act, DHS's 
Information Analysis and Infrastructure Protection Directorate is 
responsible for receiving and analyzing information from multiple sources, 
including local, state, and federal government agencies and private sector 
entities, and integrating the information, analyses, and vulnerability 
assessments to identify protective priorities. 28 



We have consistently advocated using a risk management approach in 
responding to national security and terrorism challenges. In the context of 
homeland security risk management is a systematic and analytical process 
of (1) considering the likelihood that a terrorist threat will endanger an 
asset, individual, or function and (2) reducing the risk and mitigating the 
consequences of an attack. In our work on homeland security issues, we 
have identified threat, vulnerability, and criticality assessments as key 
elements of a risk management approach. 29 These elements are defined as 
follows: 



• A threat assessment identifies and evaluates potential threats on the 
basis of factors such as capabilities, intentions, and past activities. This 
assessment represents a systematic approach to identifying potential 
threats before they materialize and is based on threat information 



'Pub.L. No. 107-71, § 112(b)(1)(B) (2001). 
5 Pub.L. No. 107-296, § 302(5)(B) (2002). 
7 Pub.L. No. 107-296, § 201(d)(2) (2002). 
*Pub.L. No. 107-296, § 201(d)(2)-(d)(3) (2002). 
'GAO-02-150T. 
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gathered from both the intelligence and the law enforcement 
communities. 30 

• A vulnerability assessment identifies weaknesses that may be exploited 
by identified threats and suggests options to address those weaknesses. 

• A criticality assessment evaluates and prioritizes assets and functions 
in terms of specific criteria, such as their importance to public safety 
and the economy. The assessment provides a basis for identifying which 
structures or processes are relatively more important to protect from 
attack. 

To select and prioritize their R&D projects, TSA and DHS have established 
processes that include risk management principles. According to TSA 
officials, TSA has completed threat assessments for all modes of 
transportation but has yet to complete vulnerability and criticality 
assessments. A DHS official told us that the department has started to 
conduct risk assessments of critical infrastructure sectors but does not 
plan to start its assessment of the transportation sector until 2005. Without 
complete risk assessments, Congress and other stakeholders are limited in 
their ability to assess whether the millions of dollars that are being invested 
in transportation security R&D projects are being spent cost-effectively and 
to address the highest transportation security risks. 

In the absence of completed risk assessments, TSA and DHS officials are 
using available threat intelligence, expert judgment, congressional 
mandates, mission needs, and information about past terrorist incidents to 
select and prioritize their R&D projects. TSA and DHS officials said that 
they obtain threat intelligence from the government's intelligence 
community to help make R&D decisions. TSA officials said that TSAs Chief 
Technology Officer receives daily intelligence briefings, and that the agency 
is using threat information to select R&D projects but is not yet using 
formal threat assessments to make those R&D decisions. In addition, DHS's 



30 As we noted in our October 2001 report on risk management, while threat assessments are 
a key decision support tool, it should be recognized that, even if updated often, threat 
assessments might not adequately capture emerging threats posed by some terrorist groups. 
No matter how much we know about potential threats, we will never know whether we have 
identified every threat or whether we have complete information even about the threats of 
which we are aware. Consequently, we believe that a risk management approach to 
preparing for terrorism that supplements threat assessments with vulnerability and 
criticality assessments can provide better assurance of preparedness for a terrorist attack. 
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Inspector General reported in March 2004 that although many Science and 
Technology officials agreed on the importance of maintaining a 
relationship with the Information Analysis and Infrastructure Protection 
Directorate, staff below them were not actively involved in obtaining 
terrorist threat information from this directorate and using the information 
to help select new homeland security technologies. 31 

In May 2004, TSA prepared terrorist threat assessments for all modes of 
transportation. In addition, in June 2004, a TSA official said that TSA is in 
the process of preparing vulnerability and criticality assessments for all 
modes of transportation. For example, in 2003, TSA supported the 
government's strategy to reduce the threat that shoulder-fired missiles pose 
to commercial aircraft by conducting vulnerability assessments at all major 
airports to identify major launch sites around the airports using 
information from local agencies and FAA. In addition to these assessments, 
officials in DHS's Information Analysis and Infrastructure Protection 
Directorate said they were working in a pilot phase toward preparing 
national comparative risk assessments with critical vulnerabilities that 
would allow comparisons to be made across different infrastructure 
sectors, such as transportation. The officials said the pilot program would 
focus on other infrastructure sectors, such as chemical and nuclear plants, 
before addressing the transportation sector, which they expected to work 
on in fiscal year 2005. However, they did not know when risk assessments 
would be completed for all modes of transportation. 

TSA has agreed with a recommendation in our past work that it should 
apply a risk management approach to strengthen security in aviation and in 
other modes of transportation. 32 TSA indicated that it is developing four 
tools, including software, that will help assess threats, criticalities, and 
vulnerabilities, and that it plans to create risk assessment models for all 
modes of transportation during fiscal year 2004. 33 



31 Department of Homeland Security, Office of Inspector General, Survey of the Science and 
Technology Directorate, OIG-04-24 (Washington, D.C.: March 2004). 

32 GAO, Aviation Security: Vulnerabilities and Potential Improvements for the Air Cargo 
System, GAO-03-344 (Washington, D.C.: Dec. 20, 2002). 

33 For an explanation of TSA's four assessment tools, see GAO, Aviation Security: Efforts to 
Measure Effectiveness and Address Challenges, GAO-04-232T (Washington, D.C.: Nov. 5, 
2003). 
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In its July 2004 report, the National Commission on Terrorist Attacks Upon 
the United States also pointed out the importance of risk management and 
recommended that the government identify and evaluate the transportation 
assets that need to be protected; set risk-based priorities for defending 
them; select the most practical and cost-effective ways of doing so; and 
then develop a plan, a budget, and funding to implement the effort. The 
plan should assign roles and missions to the relevant federal, state, and 
local authorities and to private stakeholders. We agree with the 
commission's recommendations and are making similar recommendations. 



TSA and DHS Do Not Have 
Adequate Databases to 
Effectively Manage Their 
R&D Portfolios 



R&D best practices identified by the National Research Council indicate 
that a research program should maintain a complete database of projects to 
help prioritize and justify program expenditures. Similarly, we have stated 
that an R&D program should use a management information system that 
readily provides information to track the performance of projects. TSA's 
and DHS's R&D managers were not able to provide us with complete 
information on all projects in their R&D portfolios. For example, for the 
146 projects that it funded in 2003 and 2004, TSA was not able to provide 
information on anticipated deployment dates for 91 percent, the current 
phase of development for 49 percent, and the amounts obligated and 
budgeted for 8 percent — including 3 TSA projects, CAPPS II, the 
Transportation Worker Identification Credential, and Operation Safe 
Commerce, that were appropriated tens of millions of dollars in both fiscal 
years 2003 and 2004. For the 56 projects that it funded in 2003 and 2004, 
DHS was not able to provide information on anticipated deployment dates 
for 68 percent, the current phase of development for 14 percent, and the 
amounts obligated and budgeted for 9 percent. Although TSAs and DHS's 
databases contain some information, it is scattered among several 
computer files and paper documents and cannot be easily retrieved or 
analyzed. Consequently, additional staff time is needed to prepare 
documents from different reports, and compiling the information could 
result in errors and omissions. Without accurate, complete, and timely 
information, TSA and DHS managers are limited in their ability to 
effectively monitor their R&D programs and ensure that R&D funds are 
being used to address the highest priority transportation security risks. In 
commenting on a draft of this report, DHS said that TSA had recently 
developed a database that will allow it to track milestones, funding, and 
deployment information for individual projects. 
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Coordination with Other 
Federal Agencies and 
Outreach to Transportation 
Industry Associations Has 
Been Limited 



The Aviation and Transportation Security Act and the Homeland Security 
Act require DHS to coordinate its R&D efforts with those of other 
government agencies. Similarly R&D best practices indicate that R&D 
organizations should coordinate to help fill research gaps and leverage 
resources. In addition, R&D best practices indicate that TSA and DHS 
should reach out to stakeholders, such as the transportation industry, to 
identify their security R&D needs. However, TSAs and DHS's efforts to 
coordinate with other federal agencies on transportation security R&D and 
reach out to transportation industry associations on the industry's security 
R&D needs have been limited. 



The Homeland Security Act requires DHS to coordinate with other 
executive agencies in developing and carrying out the Science and 
Technology Directorate's agenda to reduce duplication and identify unmet 
needs. 34 In addition, the Aviation and Transportation Security Act gives TSA 
responsibility for coordinating terrorism countermeasures with 
"departments, agencies, and instrumentalities of the United States 
Government." 35 For TSA and DHS to select the best technologies to 
enhance transportation security, it is important that they have a clear 
understanding of the R&D projects currently being conducted, both 
internally and externally. TSA and DHS have coordinated with each other 
on some of their transportation security R&D programs, such as efforts to 
counter the threat posed to commercial aircraft by MANPADS; develop 
technologies for detecting chemical, biological, radiological, and nuclear 
programs; and develop explosives detection systems. However, TSA and 
DHS did not coordinate their R&D portfolios in fiscal year 2003. A DHS 
official said that the department reviewed TSAs fiscal year 2004 R&D 
portfolio. The official said that it was not DHS's intention to change TSAs 
R&D portfolio but to learn what TSA was doing and to leverage resources. 

R&D best practices also emphasize the importance of coordinating R&D in 
the transportation security field. A 2002 Transportation Research Board 



34 Pub.L. No. 107-296, § 302(13) (2002). 
35 Pub.L. No. 107-71, § 101 (2001). 
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study 36 on the role of science and technology in transportation concluded 
that while TSA should have its own analysis and research capability it 
should also have the ability to draw on the "rich and varied R&D 
capabilities within the transportation sector, as well as those of the federal 
government and the science and technology community at large." 
Furthermore, the report said that if TSA views the R&D activities of DOT's 
modal agencies from a broader systems perspective, it can help fill 
research gaps, monitor the progress of these activities, and observe where 
additional investments might yield large benefits. A member of our 
transportation security and technology panel suggested that TSA and DHS 
could be more effective if they systematized and formalized their R&D 
coordination efforts at the highest levels and included other organizations, 
such as DOT and the Transportation Research Board of the National 
Research Council. 

Coordinating with DOT Coordination is limited between TSA and DOT and between DHS and DOT, 

which continues to conduct some transportation security R&D. Although 
DOT modal administration officials said that limited communication was 
occurring between DOT and TSA and between DOT and DHS about 
ongoing DOT R&D projects, none of these officials said that TSA or DHS 
had provided any input about which R&D projects they should conduct or 
had asked the modal administrations for input on which transportation 
security R&D projects TSA and DHS should conduct. An official from one 
modal administration said that TSA should consult DOT agencies about 
their R&D plans because, in some cases, they have expertise about the 
various transportation modes and are more aware than TSA of the R&D 
needs and concerns of the transportation industry. For example, a Federal 
Highway Administration (FHWA) R&D official told us that FHWA has 
conducted extensive research on tracking freight movement and has 
mapped out the movement of freight across transportation modes. This 
official said these efforts could help improve freight security. Other DOT 
R&D officials expressed similar views about their R&D programs and said 
they need to coordinate their security R&D programs with TSA and DHS to 
leverage resources and knowledge and to avoid duplication. An official 
from one DOT modal administration (the Federal Railroad Administration) 



^Transportation Research Board, Deterrence, Protection, and Preparation: The New 
Transportation Security Imperative, Special Report 270 (Washington, D.C.: 2002). The 
Transportation Research Board is a division of the National Research Council, which serves 
as an independent adviser to the federal government and others on scientific and technical 
issues. 
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said that although TSA and DHS had no formal input into the agency's R&D 
plans, all of the security-related R&D projects it had conducted since 2001 
were at the request of TSA or DHS. DOT R&D officials also said that the 
DOT modal administrations should continue to conduct some security 
R&D because they have research personnel who are experts in various 
transportation modes and could help TSA and DHS with their security R&D 
efforts. 

Coordinating with NASA and Because we found during the course of our review that NASA was also 
Other Federal Agencies conducting some transportation security R&D, we asked NASA officials 

about the extent of coordination between NASA and TSA and between 
NASA and DHS. NASA officials said that they have effective coordination 
with TSA on the transportation security R&D they conduct. 37 They said that 
TSA and NASA coordinated on identifying the types of R&D projects that 
NASA should undertake to best help meet TSAs needs. NASA officials also 
said that at DHS's request, NASA provided input to the Science and 
Technology Directorate during the directorate's strategic planning process. 
In addition, NASA officials said that they are working with TSA on a 
memorandum of agreement for their R&D programs. 

TSA and DHS officials said that coordination with other agencies and R&D 
organizations is occurring at the project level and that some coordination is 
based on personal relationships. In discussing DHS's coordination with 
other agencies in July 2004, a DHS official said that DHS relies heavily on 
the Office of Science and Technology Policy, a component of the Executive 
Office of the President, to coordinate R&D. He also noted that the 
department was only a year old, and that as it matured, DHS would know 
more about the R&D activities of other agencies. 

In creating DHS, Congress intended that DHS draw on the scientific 
expertise of the DOE national laboratories, which make up the world's 
largest system of laboratories for advanced research in support of national 
energy and defense needs. The Homeland Security Act requires DHS to 
establish an Office of National Laboratories to coordinate its R&D with that 



Coordinating with the DOE 
National Laboratories 



37 NASA's transportation security R&D focuses on aviation security, such as technologies and 
methods to provide accurate information so that pilots can avoid protected airspace, 
continually verify identity, and prevent unauthorized persons from gaining access to flight 
controls. 
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of DOE's national laboratories. 38 DHS has established this office, and in 
February 2003, DHS and DOE entered into an agreement allowing DOE to 
accept and perform work for DHS on an equal basis with other laboratory 
work. DHS and TSA are sponsoring transportation security-related R&D at 
several national laboratories, including Lawrence Livermore, Los Alamos, 
Oak Ridge, Pacific Northwest, and the Idaho National Engineering and 
Environmental Laboratory. Overall, laboratory officials told us they have an 
adequate level of communication and coordination with TSA and DHS 
about their ongoing R&D projects, but some officials believe TSA and DHS 
could use the laboratories more as resources for transportation security 
R&D and would like more information about TSAs research needs. 

Reaching Out to the In a 2001 report, the Transportation Research Board recommended that 

Transportation Industry research be closely connected to its stakeholders, such as transportation 

providers, to help ensure relevance and program support. 39 According to 
the report, stakeholders are more likely to use the research results if they 
are involved in the process from the beginning. However, most 
transportation industry association officials we interviewed said that TSA 
and DHS have not reached out to them to obtain information on their 
security R&D needs. Consequently, the transportation industry's security 
R&D needs may not be adequately reflected in TSAs and DHS's R&D 
portfolios. 

An air cargo association official said that TSA contacted them to 
participate in an air cargo security working group of the Aviation Security 
Advisory Committee, a TSA-sponsored advisory group, where they were 
able to discuss the air cargo industry's security R&D needs. Some 
transportation association officials said that TSA and DHS should contact 
them to obtain input on their research priorities to determine whether the 
proposed technologies would be useful, avoid duplication of research that 
they are sponsoring, and leverage resources. Officials from another 
aviation association commented that, in contrast to their relationship with 
TSA, they had an effective relationship with FAA. The official noted that 
information-sharing and communication occurred more frequently with 
FAA, partly because FAA management recognized the importance of 
obtaining input from the users of FAA's services, whereas TSA and DHS 



38 Pub.L. No. 107-296, § 309(g) (2002). 

^Transportation Research Board, The Federal Role in Highway Research and Technology, 
Special Report 261 (Washington, D.C.: National Academy Press, 2001). 
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have not. An official from a state highway association said that although 
TSA and DHS officials have participated in transportation research projects 
that the Transportation Research Board is conducting for the association, 
TSA and DHS have not directly contacted the association about its security 
R&D needs. A TSA official said that TSA reaches out to aviation 
associations and other organizations on R&D but has not formalized this 
process. 



TSA and DHS Have Made 
Efforts to Reach Out to 
Technology Providers, but 
Some Potential Providers 
Have Expressed Concern 
about the Process 



The Homeland Security Act authorizes DHS to solicit proposals to address 
vulnerabilities and award grants, cooperative agreements, and contracts 
with public or private entities, including businesses, federally funded R&D 
centers, and universities. 40 TSA and DHS have taken some actions to use 
this authority, but some potential technology providers believe that more 
information and communication are needed. 

One way that TSA and DHS have reached out to the private sector is 
through their membership in the Technical Support Working Group 
(TSWG), a joint program of the Departments of State and Defense that 
identifies, prioritizes, and coordinates interagency R&D requirements to 
combat terrorism. TSA and DHS have used TSWG to issue broad agency 
announcements, which request proposals from private and/or public 
entities for projects that address specific R&D needs. 41 These solicitations 
have generated substantial numbers of responses. For example, TSWG 
received more than 3,340 responses to a broad agency announcement that 
it issued for DHS in May 2003 soliciting proposals for multiple homeland 
security R&D projects, including a system for screening rail passengers and 
baggage. A DHS official said that as DHS matures, it intends to rely less on 
TSWG and more on the Homeland Security Advanced Research Projects 
Agency (HSARPA), DHS's external funding arm. 



TSA and DHS have also reached out to the private sector by linking their 
Web sites to the Federal Business Opportunities Web site, which informs 
potential technology providers about opportunities for conducting 



40 Pub.L. No. 107-296, § 307(b) (3)-(b) (4) (2002). 

41 A broad agency announcement is a competitive R&D contracting approach described in 
the Federal Acquisition Regulation in 48 C.F.R. 35.016. Broad agency announcements are 
used for the acquisition of basic and applied research and development that fulfill 
requirements for scientific study experimentation, and demonstration and that direct 
advancement of state-of-the-art technology. 
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homeland security R&D projects. In addition, TSA's Web site invites 
potential technology providers and others to submit their ideas about 
innovative security technologies that could contribute to TSA's work on 
aircraft hardening, baggage and cargo screening, credentialing, physical 
security, and electronic surveillance. According to TSA, it has evaluated 
over 1,000 proposals submitted in response to this invitation. However, 
representatives of several private companies told us of difficulties they had 
experienced in trying to communicate with TSA, navigate its Web site, 
obtain information about its R&D program, and understand its current 
transportation security R&D priorities. For example, a company official 
told us that his company was forced into guessing about TSAs long-term 
R&D strategy, and that manufacturers do not want to make a large 
investment in developing new technologies without knowing whether TSA 
will embrace those technologies. This company official suggested that TSA 
should communicate its R&D goals promptly to vendors. Similarly, some 
private company representatives told us that they did not have sufficient 
information about DHS's transportation security R&D priorities and 
requirements to adequately respond to solicitations. In commenting on a 
draft of this report, DHS noted that TSA recently established a working 
group to update and improve the current Web site's discussion of 
technology ideas, products, and services to make it more user-friendly and 
plans to implement the improvements early next year. 

HSARPA has also conducted various forms of outreach with potential 
technology providers. In September 2003, for example, it conducted a 
bidders' conference to discuss the release of a solicitation on detection 
systems for biological and chemical countermeasures. In addition, in 
November 2003, HSARPA conducted a best practices workshop that 
allowed potential technology providers to comment on how DHS could 
best keep industry informed about its priorities, make industry aware of 
agency solicitations, and manage the relationship between industry and the 
agency. The industry participants also stressed the importance of 
communication between them and DHS. In addition, some participants 
suggested that DHS issue early drafts of solicitations to allow industry to 
gain a better understanding of DHS's needs. 42 Following the workshop, in 
January 2004, DHS issued a draft solicitation, for technologies to detect 
radiological and nuclear materials, for industry comment before issuing the 
final version. 



42 We are conducting a separate review of DHS's use of its R&D procurement authorities. 
Page 41 GAO-04-890 Transportation Security R&D 



TSA and DHS have used universities to conduct some of their R&D. For 
example, in June 2004, TSA indicated that it had 24 grants with colleges and 
universities. In addition, the Homeland Security Act requires DHS to 
establish university-based centers for homeland security. 43 According to 
DHS, the centers will conduct multidisciplinary research on homeland 
security. In November 2003, DHS announced that it had selected the 
University of Southern California as its first Homeland Security Center of 
Excellence. 44 DHS will provide $12 million over 3 years for the university to 
conduct a risk analysis on the economic consequences of terrorist threats 
and events. The study will address both the targets and means of terrorism, 
with an emphasis on protecting the nation's critical infrastructure, such as 
transportation systems. 



TSA and DHS Have Taken 
Steps to Accelerate 
Congressionally Mandated 
Transportation Security 
Technologies 



Under the Aviation and Transportation Security Act, TSA is required to 
accelerate the research, development, testing, and evaluation of, among 
other things, explosives detection technology for checked baggage and 
new screening technology for carry-on items and other items being loaded 
onto aircraft, including cargo, and for threats carried on persons. 45 The 
Homeland Security Act requires DHS's HSARPA to accelerate the 
prototyping and development of technologies that "would address 
homeland security vulnerabilities." 46 Although the Homeland Security Act 
authorized a $500 million acceleration fund in fiscal year 2003, 47 a DHS 
official said that no funds were specifically appropriated for that purpose. 



Both TSA and DHS have taken steps to address congressionally mandated 
requirements to accelerate security technologies, but they are operating 
without goals and measurable objectives. As a result, it is difficult to 
determine what progress the agencies have made toward accelerating R&D 
projects. Although TSA does not yet have goals and objectives for 
measuring acceleration, the agency has funded the Phoenix project, among 
others, to accelerate baggage screening technologies in the near term. For 



43 Pub.L. No. 107-296, § 308(b)(2)(A) (2002). 

44 In April 2004, DHS announced that it had selected two other universities as Homeland 
Security Centers of Excellence, which will focus on the security of agricultural products. 

45 Pub.L. No. 107-296, § 137(a) (2002). 

46 Pub.L. No. 107-296, § 307(b)(3)(C) (2002). 

47 Pub.L. No. 107-296, § 307(c)(2) (2002). 
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fiscal year 2004, DHS budgeted $75 million for accelerating technologies 
through its Rapid Prototyping Program. For example, DHS, in coordination 
with TSWG, issued a broad agency announcement in May 2003 to support 
the development of technologies that can be rapidly prototyped and 
deployed to the field. Furthermore, in January 2004, DHS issued a broad 
agency announcement to rapidly develop detection systems for 
radiological and nuclear countermeasures. 



Although the Homeland Security Act requires TSA to remain a distinct 
entity until at least November 2004, 48 another provision of the Homeland 
Security Act requires DHS to integrate all of the department's R&D 
activities. 49 Until that integration occurs, TSA and other DHS components 
that conduct transportation security R&D are operating separately. 
However, DHS has made some efforts to promote R&D coordination within 
the department, such as holding meetings with the different components to 
discuss R&D activities and preparing inventories of the DHS components' 
R&D capabilities and ongoing projects. DHS officials said they are 
preparing a plan to meet a directive from the Secretary of Homeland 
Security to integrate the department's R&D activities by 2005. 



Conclusions ^ e na ti° ns transportation systems, many of which are open and 

accessible, are highly vulnerable to terrorist attack. Whether new 
technologies can be researched, developed, and deployed to reduce the 
vulnerability of these systems depends largely on how effectively DHS and 
TSA manage their transportation security R&D programs. The National 
Research Council has stated that effectively managing federal R&D 
programs should include consistently funding basic research because it 
offers opportunities for significant improvements in capabilities. However, 
project information provided by TSA and DHS did not show that any of the 
transportation security R&D projects that they funded in fiscal year 2003 
and budgeted for in fiscal year 2004 were in the basic research phase. While 
TSA and DHS recognize the importance of basic research, they are focusing 
their efforts on the near-term development and deployment of 
technologies. 



5 Pub.L. No. 107-296, § 424(a) (2002). 
} Pub.L. No. 107-296, § 302(12) (2002). 



DHS Plans to Integrate the 
Department's R&D 
Programs 
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Although DHS is working toward complying with legal requirements and 
implementing best practices for managing its R&D program, it is operating 
without a strategic plan for its R&D program. Furthermore, although TSA 
and DHS officials have said that they plan to use risk assessments to select 
and prioritize R&D projects, TSA has not completed vulnerability and 
criticality assessments, which are key components of risk assessments, for 
all modes of transportation. In addition, DHS has not yet completed risk 
assessments of the infrastructure sectors, such as transportation. As a 
result, Congress does not have reasonable assurance that the hundreds of 
millions of dollars that are being invested in transportation security R&D 
are being spent cost-effectively to address the highest priority 
transportation security risks. In addition, the National Commission on 
Terrorist Attacks Upon the United States recommended that the 
government identify and evaluate the transportation assets that need to be 
protected; set risk-based priorities for defending them; select the most 
practical and cost-effective ways of doing so; and then develop a plan, a 
budget, and funding to implement the effort. 

TSA and DHS also do not have adequate databases to monitor and manage 
their spending of the hundreds of millions of dollars that Congress has 
appropriated for R&D. As DHS integrates its R&D programs, including 
TSAs, it will be important for the department to have accurate, complete, 
current, and readily accessible project information that it can use to 
effectively monitor and manage its R&D portfolios. 

The limited evidence of coordination between TSA and DHS that we found, 
as well as between each of these agencies and other agencies such as DOT, 
does not provide assurance that R&D resources are being leveraged, 
research gaps are being identified and addressed, and duplication is being 
avoided. In our June 2003 report on transportation security challenges, we 
recommended that DHS and DOT use a mechanism such as a memorandum 
of agreement to clearly delineate their respective roles and responsibilities. 
DHS and DOT disagreed with this recommendation because they believed 
that their roles and responsibilities were already clear. However, we 
continue to believe that DHS's and DOT's roles and responsibilities for 
transportation security, including their respective security R&D programs, 
should be clarified because the Aviation and Transportation Security Act 
gives TSA responsibility for securing all modes of transportation but does 
not eliminate the DOT modal administrations' existing statutory 
responsibilities for the security of different modes of transportation. 
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Finally, because most transportation industry associations told us that TSA 
and DHS have not contacted them about their security R&D needs, the 
security R&D needs of transportation providers may not have been 
adequately considered. 



Recommendations for 
Executive Action 



To support efforts by TSA and DHS to maximize the advantages offered by 
basic research, help select and prioritize R&D projects, better monitor and 
manage their R&D portfolios, enhance coordination with one another and 
with other organizations that conduct transportation security R&D, and 
improve their outreach to transportation, we are making five 
recommendations. Specifically, we recommend that the Secretary of 
Homeland Security and the Assistant Secretary of Homeland Security for 
the Transportation Security Administration 



• ensure that their transportation security R&D portfolios contain 
projects in all phases of R&D, including basic research; 

• complete (1) strategic plans containing measurable objectives for TSAs 
and DHS's transportation security R&D programs and (2) risk 
assessments — threat, vulnerability, and criticality — for all modes of 
transportation, and use the results of the risk assessments to help select 
and prioritize R&D projects; 

• develop a database that will provide accurate, complete, current, and 
readily accessible project information for monitoring and managing 
their R&D portfolios; 

• develop a process with DOT to coordinate transportation security R&D, 
such as a memorandum of agreement identifying roles and 
responsibilities and designating agency liaisons, and share information 
on the agreed-upon roles and responsibilities with transportation 
stakeholders; and 

• develop a vehicle to communicate with the transportation industry to 
ensure that its R&D security needs have been identified and considered. 



Agency Comments and 
Our Evaluation 



We provided TSA, DHS, and DOT with drafts of this report for their review 
and comment. DHS's written comments, which incorporated comments 
from TSA, are provided in appendix IV, along with our responses to specific 



Page 45 



GAO-04-890 Transportation Security R&D 



points. DOT also provided comments on the draft report, which we have 
incorporated into the report as appropriate. 

DHS generally concurred with the report's findings and commented that 
the recommendations are key to a successful R&D program and that the 
department would continue to evaluate its R&D processes in light of the 
report's findings and recommendations. However, DHS believed that the 
report did not sufficiently recognize recent changes that have taken place, 
particularly at TSA. According to DHS, TSA has made great strides in 
defining R&D projects and linking them to mission needs and identified 
gaps. In response to these and other technical comments that DHS 
provided, we revised the report as appropriate. 

DHS also provided additional perspectives on our recommendations: 

• Recommendation: TSA and DHS should ensure that their 
transportation security R&D portfolios contain projects in all phases 
of R&D, including basic research. DHS said that TSA's Transportation 
Security Laboratory currently conducts basic research and that TSA's 
human factors program, Manhattan II project, and air cargo security 
projects include basic research. However, information provided by TSA 
in July 2004 in response to our request for data on projects, including 
their current phase of research, identified no projects in the basic 
research phase. This information from TSA covered the agency's R&D 
work on human factors, Manhattan II, and air cargo security. In addition, 
a senior TSA official said that the agency needed to do more basic 
research. In light of this information from TSA, we did not change our 
recommendation. 

• Recommendation: TSA and DHS should (1) complete strategic plans 
containing measurable objectives for TSA's and DHS's transportation 
security R&D programs and (2) complete risk assessments for all 
modes of transportation, and use the results of the risk assessments to 
help select and prioritize R&D projects. DHS said that in 2004, it 
finalized its strategic plan, which defined missions and goals for all of 
the agencies under it, including TSA. DHS also said that the strategic 
plan being developed by TSA's Office of Security Technology would 
include measurable goals and milestones for R&D projects. However, 
DHS's strategic plan does not specifically address transportation 
security R&D and neither TSA nor DHS has completed an R&D strategic 
plan containing measurable objectives. Therefore, we did not revise this 
recommendation. 
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• Recommendation: TSA and DHS should develop a database that will 
provide accurate, complete, current, and readily accessible project 
information for monitoring and managing their R&D portfolios. DHS 
said that TSA had developed a system to track R&D projects' goals and 
milestones, acquisition, funding, testing, and deployment information. 
While such a project tracking system could address our 
recommendation, TSA struggled as recently as of August 2004 to provide 
us with basic information on many of its R&D projects and, in the end, 
was unable to do so for a significant number. Therefore, we retained this 
recommendation. 

• Recommendation: TSA should develop a process with DOT to 
coordinate transportation security R&D, such as a memorandum of 
agreement identifying roles and responsibilities, and share this 
information with transportation stakeholders. DHS said that TSA is 
already working with DOT to avoid duplicative R&D efforts. In addition, 
DHS said that TSA would assess the benefits associated with a 
memorandum of agreement with DOT to determine whether one should 
be initiated. We continue to believe that a memorandum of agreement 
between TSA and DHS is the proper vehicle for coordinating R&D — not 
only to avoid duplication, but also to leverage resources and identify 
unmet needs. Furthermore, DOT concurred with our finding that there 
is room for significant improvement in coordination between DOT and 
TSA and between DOT and DHS. DOT also agreed with our 
recommendation that a memorandum of agreement with DHS is the 
appropriate vehicle for improving the coordination of transportation 
security R&D. 

• Recommendation: TSA and DHS should develop a vehicle to 
communicate with the transportation industry to ensure that their 
R&D needs have been identified and considered. DHS said that TSA 
does and will continue to communicate with the transportation industry. 
Although DHS noted some actions that TSA is taking to reach out to the 
transportation industry, as we reported, most transportation industry 
officials we interviewed said that TSA and DHS had not reached out to 
them to obtain information about their transportation security R&D 
needs. Therefore, we did not change this recommendation. 

Finally, DHS commented on the draft report's conclusion that Congress has 
no reasonable assurance that the hundreds of millions of dollars that are 
being invested in transportation security R&D are being invested cost- 
effectively to address the highest priority transportation risks. According to 
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DHS, this conclusion is contradicted by evidence contained in our report, 
namely, that the report underscores the difficulties of integrating multiple 
new agencies missions, resources, and approaches. However, we believe 
that the report's evidence of incomplete strategic planning and risk 
assessment, inadequate information management, and insufficient 
coordination supports the conclusion. Given that DHS generally concurred 
with all of the recommendations, which address these issues, and said they 
were key to a successful R&D program, we believe that implementing them 
will strengthen TSA's and DHS's ability to provide Congress with 
reasonable assurance that the hundreds of millions of dollars that are being 
invested in transportation security R&D are being invested cost-effectively 
to address the highest priority transportation security risks. 

In its comments on the draft report, DOT said that its efforts to coordinate 
research planning with DHS and TSA support our finding that there is room 
for significant improvement. According to DOT, it offers substantial 
transportation expertise that could provide critical input for identifying and 
prioritizing the transportation security R&D agenda. DOT also said that it is 
anxious to work with DHS and TSA to create a mutually beneficial working 
environment that taps its transportation experience and expertise while the 
department benefits from DHS's security expertise. DOT believes that 
through effective interagency coordination, it could work with DHS and 
TSA to ensure that important research needs are met in areas such as 
critical transportation infrastructure protection, as well as in responding 
to, and recovering from, a terrorist attack on the transportation system. 
Finally, DOT said that coordinating R&D activities represents an area that 
could benefit by being included in an annex to an overall memorandum of 
agreement between DOT and DHS such as we recommended. DOT said it 
fully supports the completion of a comprehensive memorandum of 
agreement with DHS and is working to bring one to fruition. 



As arranged with your offices, unless you publicly announce its contents 
earlier, we plan no further distribution of this report until 20 days after the 
date of this letter. At that time, we will send copies of this report to 
interested congressional committees and to the Secretary of Homeland 
Security, the Secretary of Transportation, the Secretary of Energy, the 
Secretary of Defense, the Assistant Secretary of Homeland Security for the 
Transportation Security Administration, and the Administrator of the 
National Aeronautics and Space Administration. We will make copies 
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available to others upon request. In addition, this report will be available at 
no charge on our Web site at http://www.gao.gov. 

Key contributors to this report are listed in appendix V. If you have any 
questions about this report, please contact me on (202) 512-2834 or at 
siggerudk@gao.gov. 




Katherine Siggerud 

Director, Physical Infrastructure Issues 
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Appendix I 



Objectives, Scope, and Methodology 



The objectives of this report were to review (1) the transportation security 
research and development (R&D) projects that the Transportation Security 
Administration (TSA), the Department of Homeland Security (DHS), and 
other agencies funded in fiscal year 2003 and have budgeted for in fiscal 
year 2004; the status of these projects; and the reasonableness of the 
distribution of these projects by mode and (2) the extent to which TSA and 
DHS are managing their transportation security R&D programs according 
to applicable laws and best practices recommended by the National 
Academy of Sciences and the National Research Council. 

To complete our first objective, we obtained and analyzed information from 
TSA, DHS, and the Department of Transportation (DOT) on the 
transportation security R&D projects that they were funding and are 
planning to fund. Within DHS, in addition to TSA and the Science and 
Technology Directorate, we collected this information from the U.S. Coast 
Guard, the U.S. Customs and Border Protection agency, and the U.S. Secret 
Service, which DHS officials identified as also conducting transportation 
security R&D. Information on the transportation security R&D projects 
that TSA and DHS plan to fund in fiscal year 2005 was not yet available. 
Because we found during our review that DOT was continuing to conduct 
some transportation security R&D, we obtained and analyzed information 
on the transportation security R&D projects that it was funding in fiscal 
years 2003 and 2004. At DOT, we obtained this information from the 
Federal Railroad Administration, the Federal Transit Administration, the 
Federal Highway Administration, the Federal Motor Carriers Safety 
Administration, the Office of Pipeline Safety, and the Research and Special 
Projects Administration. Regarding their transportation security R&D 
projects, we asked these agencies to provide project descriptions and 
information on who was performing the research (such as private 
contractors or national laboratories); their phase of research; anticipated 
dates of completion, initial deployment, and deployment; and funding data 
for fiscal years 2003 and 2004. We then aggregated these data to determine 
the focus of TSAs and DHS's transportation security projects in terms of 
the modes of transportation and program areas. On the basis of interviews 
with TSA, DHS, DOT, and National Aeronautics and Space Administration 
(NASA) officials regarding how their agencies ensure that these data are 
complete and accurate, we determined that these data were sufficiently 
reliable for purposes of this report. To gain a better understanding of the 
types of technologies involved in transportation security, we reviewed 
reports prepared by GAO, the DOT Inspector General, the Homeland 
Security Research Corporation (a private research organization), and 
others and attended conferences where transportation security R&D- 
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Objectives, Scope, and Methodology 



related technologies were discussed. To help evaluate the reasonableness 
of the R&D projects that TSA, DHS, and DOT have funded in terms of the 
modes of transportation and program areas addressed, we convened a 
meeting of transportation security and technology experts. At our request, 
the National Research Council selected the experts, who were affiliated 
with state transportation departments, universities, national laboratories, 
private industry, and other organizations and were knowledgeable about 
transportation security technologies. 

To complete our second objective, we first identified and reviewed the laws 
relevant to the management of TSAs and DHS's R&D programs, including 
the Aviation and Transportation Security Act, the Homeland Security Act, 
and the Government Performance and Results Act. We also identified and 
reviewed best practices applicable to R&D programs identified by leading 
research organizations, such as the National Research Council and the 
National Academy of Sciences. In addition, we interviewed TSA and DHS 
officials about their strategic planning, coordination, and R&D acceleration 
efforts. We also reviewed GAO reports on TSAs strategic planning, on 
DHS's interaction with the Department of Energy (DOE) National 
Laboratories, on risk management principles, on implementing the 
Government Performance and Results Act, and on transportation security 
challenges and a DHS Inspector General report on the Science and 
Technology Directorate's operations. We then compared these laws and 
best practices with TSAs and DHS's management of their R&D programs. 
To determine the extent to which TSA and DHS were coordinating with 
each other and other federal agencies, we interviewed officials at TSA, 
DHS, DOT, NASA, the Technical Support Working Group, five DOE national 
laboratories that were conducting transportation security R&D for TSA or 
DHS, and three universities that were conducting R&D for TSA. We visited 
the national laboratories in Oak Ridge, Tennessee, and Los Alamos, New 
Mexico, because the Oak Ridge National Laboratory was conducting more 
transportation security R&D projects for TSA, and the Los Alamos National 
Laboratory was conducting more transportation security projects for DHS, 
compared with the other national laboratories. To determine the extent to 
which TSA and DHS had outreached to the transportation industry and 
potential technology providers, we interviewed officials from 
transportation industry associations and attended DHS industry 
workshops. In addition, we interviewed a number of members of the 
Homeland Security Industries Association, an organization of homeland 
security technology vendors, to obtain their views on TSAs and DHS's 
technology solicitation processes and outreach efforts. The association 
identified the members who chose to discuss their views with us. At our 
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request, the transportation security and technology experts also provided 
comments on TSA's and DHS's management of their R&D programs. 

We conducted our review in Washington, D.C.; Arlington, Virginia; Atlantic 
City, New Jersey; Oak Ridge, Tennessee; and Los Alamos, New Mexico, 
from July 2003 through September 2004 in accordance with generally 
accepted government auditing standards. 
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Appendix II 

Industry Is Independently Developing New 
and Emerging Transportation Security 
Technologies 



According to a TSA official, private industry and universities are 
researching and developing several new and emerging technologies that 
are applicable to transportation security, in some cases without any 
funding from TSA or DHS. The official said that TSA has focused most of its 
R&D on making improvements to deployed technologies and testing and 
evaluating near-term technologies. However, the official stated that TSA 
needs to start devoting more funding to researching and developing long- 
term, high-risk, but potentially high-payoff technologies. Examples of new 
and emerging technologies include the following: 

• Terahertz imaging uses terahertz radiation 1 to create images of 
concealed objects or to reveal their chemical composition. The rays can 
be directed at a person or an object from a source, with reflected rays 
captured by a detection device. The Homeland Security Research 
Corporation (a private research organization) reports that terahertz 
imaging will be an excellent tool for screening baggage. Terahertz 
imaging has been used in the laboratory to detect explosives on people 
through several layers of clothing. TSA is considering funding the 
development of this technology for detecting explosives in 
containerized air cargo. 

• Nuclear resonance fluorescence imaging uses a high-intensity light 
source to identify the atomic composition of a target object. Nuclear 
resonance fluorescence imaging has the potential to detect explosives 
and nuclear materials in baggage, trucks, and cargo containers. 
According to a TSA official, TSA may fund R&D on this technology in 
the future. 



• Microsensors are miniature devices that convert information about the 
environment into an electrical form that can be read by instruments. 
There are many types of microsensors, some of which have the potential 
to detect explosives. In fiscal year 2003, TSA funded R&D at two 
national laboratories and NASA on several different types of 
microsensors. A TSA official said that several universities are currently 
doing work on other types of microsensors that have potential to meet 
TSAs needs, but that TSA did not fund any of this work in 2004. 



terahertz radiation is the part of the electromagnetic spectrum between microwave 
radiation and infrared radiation. With wavelengths of between 30 micrometers and 1 
millimeter, it is non-ionizing and harmless to living tissue. 
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Industry Is Independently Developing New 
and Emerging Transportation Security 
Technologies 



• Automated detection algorithms are computer software that processes 
data obtained by detection systems and automatically indicates the 
presence of an explosive or weapon. Although TSA has funded the 
development of such software for its currently deployed computed 
tomography explosives detection systems, it has not yet funded the 
development of such software to process images produced by emerging 
detection technologies, such as X-ray backscatter and millimeter wave. 2 
A TSA official believes that incorporating automated detection 
algorithms could substantially reduce the operational cost of future 
detection systems by reducing the need for screeners. According to this 
official, TSA may fund the development of these algorithms in the 
future. 

• Raman spectroscopy uses laser light to determine the chemical 
composition of an object and can be used to screen passengers, carry-on 
and checked baggage, cargo, and boarding passes for explosives. 

• Nuclear magnetic resonance directs radio waves at an object that has 
been placed in a magnetic field to determine the presence of explosives. 
Nuclear magnetic resonance can be used to screen liquids in containers 
in carry-on and checked baggage for explosives. 



2 Backscatter X-ray detects reflected X-ray energy, providing an image that highlights organic 
materials, such as explosives. Millimeter wave energy analysis provides a 360-degree image 
of a person or object in order to detect weapons and explosives. 
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Name 


Affiliation 


Expertise 


Norm Abramson - Chair 


Southwest Research Institute 


Research policy 


David Albright 


New Mexico Department of Transportation 


Surface transportation 


Cheryl Bitner 


AAI Corporation 


Human factors, passenger screening 
technologies 


Joedy Cambridge 


National Research Council, Transportation 

Rpcparph RnarH 
ncocaioi i uuqi u 


Transportation policy 


Rnhprt fnPllpmnrp 
nuuci i \-Acx\ i di i c 


Nn rthwpcitprn 1 lni\/prQit\/ 
inui ii i vvcoici 1 1 \j\ iivcioiiy 


ridi 1 1 uauo , oy uci oci-u 1 1 ly 


Patrick Griffin 


Sandia National Laboratories 


Transportation security technologies, neutron 

cnpr k trnQr k nr»\/ 
opcuii uoou|jy 


ictouv ndiiiico 


1 lni\/prQit\/ nf \/irninia 
L^iMvcioiiy kj\ viiyMiici 


riiof\ ell idiyoio 


Daniel Hall 


Washington Metropolitan Area Transit 

AAUll IUI iiy 


Mass transit 


Douglas Harris 


Anacapa Sciences 


Human factors 


William Harris 


Consultant 


Commissioner - President's Council on Critical 
Infrastructure Protection 


Thomas Hartwick 


Consultant 


Transportation security technologies 


Sandra Hyland 


Tokyo Electron Massachusetts 


Transportation security technologies 


James Killian 


National Research Council, National 
Materials Advisory Board 


Transportation security 


Eva Lerner-Lam 


Palisades Consulting Group 


Maritime/Land security 


Len Limmer 


Consultant 


Airports, passenger screening technologies 


Terry Lowe 


Los Alamos National Laboratory 


Organization 


Toni Marechaux 


National Research Council, National 
Materials Advisory Board 


Transportation security technologies 


Harry Martz 


Lawrence Livermore National Laboratory 


X-ray technologies, nondestructive evaluation 


Emily Ann Meyer 


National Research Council, National 
Materials Advisory Board 


Technology policy 


Dan Murray 


American Transportation Research Institute 


Trucking and freight transportation security and 
technologies 


Daniel O'Neil 


CRADA International 


Chair, Transportation Research Board 
Committee on Critical Transportation 
Infrastructure Protection 


Clint Oster 


Indiana University, School of Public & 
Environmental Affairs 


Cargo/Baggage Screening, Aviation, 
Transportation Infrastructure 


Joseph Schofer 


Northwestern University 


Incident response and management on 
transportation networks 


Eric Schwartz 


The Boeing Company 


Aviation and aircraft technology 


Edmund Soliday 


Consultant 


Airlines, passenger screening technologies 
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Name 


Affiliation 


Expertise 


Mike Story 


Consultant 


Mass spectrometry, passenger screening 
technologies 


Joyce Wenger 


Science Applications International 
Corporation 


Freight, intelligent transportation, traffic 
modeling 


Jeffery Western 


Wisconsin Department of Transportation 


Surface Transportation - Highways 



Source: National Research Council. 



Note: These experts either attended the March 2, 2004, meeting or provided written comments after 
reviewing information that we provided to them. 
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Note: GAO comments 
supplementing those in 
the report text appear 
at the end of this 
appendix. 



U.S. Department of Homeland Security 

Washington, DC 20528 



/|§ft\ Homeland 
W Security 



September 10, 2004 



Ms. Katherine Siggerud 

Director, Physical Infrastructure 

U.S. Government Accountability Office 

441 G Street, N.W. 

Washington, D.C. 20548 

Re: GAO-04-890, Transportation Security R&D: TSA and DHS Are Researching and 
Developing Technologies, but Need to Improve R&D Management, September 2004, 
GAO Case 540068 

Dear Ms. Siggerud: 

Thank you for the opportunity to comment on the draft report referenced above. The 
Department of Homeland Security (DHS) appreciates the work done in this report to identify 
areas where transportation security R&D management can be improved. DHS believes that 
GAO's identification of areas for improvements will contribute to the efficiency and 
effectiveness of R&D management at TSA and throughout the DHS. We generally concur 
with the report and its recommendations and appreciate the discussion of challenges and next 
steps this report contains. However, there are areas within the report about which we would 
like to comment. 

DHS believes that the report does not provide sufficient recognition of recent changes that 
have taken place, particularly at TSA. In March of 2003, the TSA took over the operational 
management of the R&D program previously operated by the Federal Aviation 
Administration (FAA). Since that transition, TSA has made great strides in defining R&D 
projects and linking them to mission needs and identified gaps. While we recognize that there 
is a great deal of work ahead, it is important to bear in mind that designing a program that will 
support the many needs of DHS and TSA cannot happen in a haphazard manner and must be 
built over time. While immediate needs were associated with the aviation sector, since 2003, 
TSA's R&D and operational testing and evaluation programs have expanded to include the 
other transportation modes, recognizing that the role of TSA is much different for those 
modes than it is for aviation. 

Comments on GAO Recommendations 

GAO made the following five recommendations regarding Transportation Security R&D: 

1. Ensure that their transportation security R&D portfolios include all phases of R&D 
including some basic research; 



www.dhs.gov 
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2. Complete (1) strategic plans containing measurable objectives for TSA's and DHS's 
transportation security R&D programs and (2) risk assessments-threat, vulnerability 
and criticality-for all modes of transportation and that they use the results of the risk 
assessments to help select and prioritize R&D priorities; 

3. Develop a database/management information system that will provide accurate, 
complete, current, and readily accessible project information for monitoring and 
managing their R&D portfolios; 

4. Develop a process with DOT to coordinate transportation security R&D, such as 
memorandums of understanding identifying roles and responsibilities with 
transportation stakeholders; and 

5. Develop a vehicle to communicate with the transportation industry to ensure that its 
R&D security needs have been identified and considered. 

We agree that these recommendations are key to a successful R&D program. Since its 
inception, TSA has been conducting R&D using these processes and philosophies and 
continues to improve on them as TSA and DHS mature. 

1. TSA's Transportation Security Laboratory (TSL) currently conducts basic research 
and has done so over the years it was operating under the Department of 
Transportation (DOT) umbrella. A number of our projects under the Human Factors 
Program are basic research and the results apply to several of our transportation 
security programs. Additionally, the TSL issues numerous grants per year that support 
basic research. We also recognize we need to expand basic research to include 
technology, and have done so in our Next Generation EDS Manhattan II project, and 
our air cargo security R&D. 

2. In 2004, DHS finalized their strategic plan. The plan defined the missions and goals 
for all of the agencies under DHS to include the TSA. Based on the DHS strategic 
plan, TSA is currently finalizing its strategic plan, and TSA's Office of Security 
Technology (OST) specifically is developing its strategic plan that outlines 
measurable objectives. The OST plan will include measurable goals and milestones 
regarding R&D projects. 

3. The TSA OST developed a Project Tracking System built specifically to track R&D 
projects goals and milestones, acquisition, funding, testing, and deployment 
information. This system will allow TSA to more accurately track R&D initiatives. 
To establish the overall framework for OST technology programs and to set the stage 
for the implementation of the processes and mechanisms described above, higher-level 
management documents are developed. The highest-level OST technical document is 
this Technology Master Plan. At the next level, Product Area Master Plans are 
developed to provide a framework for all of the programs within a product area. Each 
Product Area Master Plan outlines the scope of the product area, summarizes the 
programs defined under the product area, presents high-level schedules for the 
programs and provides high-level budgetary information for the programs. 

4. TSA works with the DOT to ensure there are no duplicative R&D efforts. TSA will 
assess the benefits associated with an MOU with DOT to determine if in fact one 
should be initiated. 

2 
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5. TSA does and will continue to communicate with the transportation industry. In 
addition to the Aviation Security Advisory Committee discussed by the GAO, TSA 
also works directly with industry stakeholders on specific R&D efforts. The TSA 
OST is also a presenter and participant in the weekly Intermodal Conference Call held 
by the TSA's Assistant Secretary to provide an update on technology, and solicit input 
from industry. This call typically attracts Federal Railroad Administration, Federal 
Transit Administration, DOT, and multiple industry leaders ranging from the National 
Association for School Buses, to AMTRAK, to the American Trucking Association. 



General Comments on the GAO Report 



See comment 1 . 



See comment 2. 



See comment 2. 



See comment 2. 



The GAO commented that TSA used a majority of its R&D funding on aviation 
security versus other modes of transportation. While aviation security is currently the 
primary focus of TSA's R&D projects, many aviation projects provide data that is 
useful for other transportation security programs. Much of what is learned from these 
projects is easily adapted for other modes of transportation. For example, funding was 
categorized as aviation security for explosive trace portals and these portals were 
recently used in a rail security initiative. 

GAO outlined three projects that panelists from their transportation and security panel 
suggested be considered for future funding. 

o The first recommendation is for a project that combines neutron inspection 
technology with traditional transmission x-ray and backscatter x-ray 
technologies to enhance air cargo security. The TSA is already looking at 
pulsed fast neutron analysis (PFNA), which is a technology that utilizes x-ray 
images in conjunction with neutrons interrogation and substance identification. 
TSA has already spent close to $3 million supporting this technology, and is 
currently working with U.S. Customs and Border Patrol and the Department of 
Defense to demonstrate the utility of this technology. 

o The second recommendation was for a multifunctional portal that tests for 
metal, explosives, narcotics, and chemicals in near real-time. The TSA agrees 
with this recommendation. Pursuing technology fusion is critical, and this has 
certainly been an R&D goal for security transportation for some time. TSA 
has prototypes from two different vendors, with whom TSA is working to 
integrate automated metal/explosives detection portals. These next generation 
portals will demonstrate true integration. At this point in their R&D program, 
TSA is in the process of identifying and addressing the strengths and 
weaknesses of subcomponent technology before trying to integrate two 
systems into one. TSA is examining quadruple resonance, x-ray backscatter, 
and millimeter wave technology as sub-elements to metal and trace explosives 
detection portals now commercially available. 

o Lastly, the panelists recommended the development of a standard piece of 
luggage for testing deployed explosives detection systems (EDS) to ensure that 
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See comment 3. 



See comment 4. 



See comment 5. 



they maintain acceptable performance capabilities. TSA does implement a 
system validation process for all technology it deploys, including EDS. 

We believe that the report should indicate that TSA does have two overview 
committees, the National Academy of Sciences and the Security Advisory Panel, that 
contain experts from elements of transportation. 

GAO reported that one of their security expert panelists did not agree with funding a 
$30,000 project to test a prototype of a new, hand-held ion mobility spectrometry 
explosives trace detector because, according to the panelist, at least two very good ion 
mobility spectrometry hand-held units can be purchased off the shelf. The reason 
TSA funded this project was that the vendor demonstrated a novel vortex sampler that 
showed promise as an advanced sample collector. TSA is actively seeking automated 
trace sampling technology that can be used with any detection platform. In this 
instance the detector happened to be an ion mobility spectrometer, but the focus of this 
R&D effort was to demonstrate a device that could find explosives residues in an 
automated fashion. 

The report states that TSA has focused its R&D efforts on near-term development, 
however, during FY 2004 TSA embarked on several long-term research projects. 
Specifically, TSA will go to award on some proposals received for the Manhattan II 
project. Manhattan II is designed to explore next-generation technology to create 
revolutionary approaches to screening checked baggage. TSA expects to award Phase 
I feasibility studies in September to a number of bidders who submitted proposals 
under a Broad Agency Announcement (BAA) for next generation technology. 
Additionally, the TSA will go to award under some proposals for development of air 
cargo screening technologies. Although to date, still in the procurement-sensitive 
stage, the TSA is exploring a number of approaches with varying levels of technical 
risk but potential high payoff. 

The report states that "Strategic Plans for TSA's and DHS's R&D Programs do not yet 
contain measurable objectives." TSA has adopted a strategic planning process that 
allows it to sharpen its organizational and operational focus, providing the basis for 
establishing and maintaining a performance-driven organization. The process begins 
with the formulation of a strategic mission, vision, and values. After assessing the 
internal and external environment, strategic goals, objectives, and activities are 
formulated and written in a Strategic Plan to help guide TSA's efforts in achieving its 
mission and values. The general goals and objectives in the Strategic Plan are linked 
to the annual performance goals in the budget. 

A critical component of the TSA planning process is the monitoring and reporting of 
progress in achieving strategic goals. TSA has established performance measures that 
link directly to the goals and objectives in the Strategic Plan. Currently, these 
measures are not included in the strategic plan. However, TSA has developed 
performance monitoring and reporting systems that collect performance measures and 
other data continuously and report periodically. Progress on achieving performance 
targets are reported periodically to DHS, external policy makers, and the public. 
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See comment 6. 



Results are used to evaluate programs and to determine if any corrective actions need 
to be taken. 

• The report states that Congress has no reasonable assurances that the hundreds of 
millions of dollars that are being invested in transportation security R&D are being 
spent as cost-effectively as possible to address the highest-priority transportation 
security risks. This reference contradicts this two-year study by GAO on this very 
issue, as described in the report. Taken in total, this report does not paint a picture of 
irresponsibility; rather, we believe it paints a picture of the difficulties of integrating 
multiple new agencies' missions, resources, and approaches. TSA has established 
databases that are used to track individual projects, critical milestones, and funding 
spent. Additionally, as mentioned in the response to recommendation 3, TSA OST 
has adopted a Project Tracking System built specifically to track R&D projects, goals, 
milestones, acquisitions, funding, testing, and deployment information. This is a web- 
based system, which can be accessed by both the Tech Lab in Atlantic City and TSA 
headquarters in Arlington, VA. 

• GAO reported that several private companies commented that they had experienced 
difficulty in navigating TSA's website regarding communicating innovative 
technology ideas. TSA recently established a working group tasked to update and 
improve the current website regarding Technology Ideas, Products, and Services to 
make it more user-friendly and provide more information to users. The improvements 
will be implemented early next year. 

We appreciate your review of transportation security R&D management at DHS and thank 
you for the thorough analysis and discussion that comprises this report. We will continue 
to reevaluate our R&D processes in light of the findings and recommendations of this 
report. 

Thank you for the opportunity to contribute comments to the draft report. 



Sincerely, 




Anna F. Dixon 

Director, GAO/OIG Liaison 
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The following are GAO's comments on the Department of Homeland 
Security's letter dated August 31, 2004. 



QAO Comments ^ e a § ree w &h DHS that aviation security is currently the primary focus 

of TSAs R&D projects, and that many aviation projects provide data 
that are useful for other transportation security programs. Because 
these topics were discussed in the draft report, we made no change. 

2. DHS provided comments on three projects that members of our panel 
of transportation security experts suggested should be considered for 
future funding. We added this information to the report. 

3. DHS said that the report should indicate that TSA has two advisory 
committees — the National Academy of Sciences and the Security 
Advisory Panel — that contain experts from various modes of 
transportation. We added this information to the report. 

4. DHS commented on a project that one of our panelist believed should 
not be funded (a $30,000 project to test a prototype of a new, handheld 
ion mobility spectrometry explosives trace detector) because it could 
be purchased off the shelf. According to DHS, TSA funded this project 
because the vendor demonstrated a promising technology. We added 
this comment to our report. 

5. We continue to believe that DHS's and TSAs R&D strategic plans should 
contain measurable objectives. Similarly, the National Academy of 
Science indicated that research programs should be described in 
strategic and performance plans. Therefore, we made no changes to the 
report in response to this comment. 

6. DHS noted that TSA recently established a working group to update 
and improve the current Web site that addresses technology ideas, 
products, and services to make it more user-friendly. TSA plans to 
implement the improvements early next year. We added this 
information to the report. 
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accountability of the federal government for the American people. GAO 
examines the use of public funds; evaluates federal programs and policies; 
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